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Abstract 

We give a quantum algorithm for evaluating formulas over an extended gate set, including all two- 
and three-bit binary gates (e.g., NAND, 3- majority). The algorithm is optimal on read-once formulas 
for which each gate's inputs are balanced in a certain sense. 

The main new tool is a correspondence between a classical linear-algebraic model of computation, 
"span programs," and weighted bipartite graphs. A span program's evaluation corresponds to an 
eigenvalue-zero eigenvector of the associated graph. A quantum computer can therefore evaluate the 
span program by applying spectral estimation to the graph. 

For example, the classical complexity of evaluating the balanced ternary majority formula is unknown, 
and the natural generalization of randomized alpha-beta pruning is known to be suboptimal. In contrast, 
our algorithm generalizes the optimal quantum AND-OR formula evaluation algorithm and is optimal 
for evaluating the balanced ternary majority formula. 



1 Introduction 

A formula on gate set S and of size is a tree with N leaves, such that each internal node is a gate 
from S on its children. The read-once formula evaluation problem is to evaluate (p{x) given oracle access 
to the input string x = X1X2 ■ ■ .Xf^. An optimal, 0(-\/]V)-query quantum algorithm is known to evaluate 
"approximately balanced" formulas over the gates S = {AND, OR, NOT} [A CR+07| . We extend the gate 
set S. We develop an optimal quantum algorithm for evaluating balanced, read-once formulas over a gate 
set S that includes arbitrary three-bit gates, as well as bounded fan-in EQUAL gates and bounded-size 
{AND, OR, NOT, PARITY} formulas considered as single gates. The correct notion of "balanced" for a 
formula including different kinds of gates turns out to be "adversary-balanced," meaning that the inputs to 
a gate must have exactly equal adversary lower bounds. The definition of "adversary-balanced" formulas 
also includes as a special case layered formulas in which all gates at a given depth from the root are of the 
same type. 

The idea of our algorithm is to consider a weighted graph G{ip) obtained by replacing each gate of the 
formula (p with a small gadget subgraph, and possibly also duplicating subformulas. [Figure I\ has several 
examples. We relate the evaluation of (p to the presence or absence of small-eigenvalue eigenvectors of the 
weighted adjacency matrix ^0(1^) that are supported on the root vertex of G{ip). The quantum algorithm 
runs spectral estimation to either detect these eigenvectors or not, and therefore to evaluate tp. 

As a special case, for example, our algorithm implies: 

Theorem 1.1. A balanced ternary majority (MAJ3) formula of depth d, on N ~ S'' inputs, can be evaluated 
by a quantum algorithm with bounded error using 0(2'') oracle queries, which is optimal. 

The classical complexity of evaluating this formula is known only to lie between il{{7/3)'^) and o((8/3)'^), 
and the previous best quantum algorithm, from f ACR"'"07 , used 0{V5 ) queries. 
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Figure 1: To convert a formula Lp to the corresponding graph G{(p), we recursively apply substitution rules 
starting at the root to convert each gate into a gadget subgraph. Some of the rules are shown here, except 
with the edge weights not indicated. The dangling edges at the top and bottom of each gadget are the input 
edges and output edge, respectively. To compose two gates, the output edge of one is identified with an 
input edge of the next (see Figure 4 1 . 



The graph gadgets themselves are derived from "span programs" |KW93j . Span programs have been used 
in classical complexity theory to prove lower bounds on formula size |KW93I IBGW99] and monotone span 
programs are related to linear secret-sharing schemes | iBGP96| . (Most, though not all |AB099j . applications 
are over finite fields, whereas we use the definition over C.) We will only use compositions of constant-size 
span programs, but it is interesting to speculate that larger span programs could directly give useful new 
quantum algorithms. 



Classical and quantum background The formula evaluation problem has been well-studied in the 
classical computer model. Classically, the case S — {NAND} is best understood. A formula with only NAND 
gates is equivalent to one with alternating levels of AND and OR gates, a so-called "AND-OR formula," 
also known as a two-player game tree. One can compute the value of a balanced binary AND-OR formula 
with zero error in expected time 0(7Vi°g2[(i+V33)/4l) ^ 0(iV° '^54) |Sni85l [SW86] . and this is optimal even 
for bounded-error algorithms |San95] . However, the complexity of evaluating balanced AND-OR formulas 
grows with the degree of the gates. For example, in the extreme case of a single OR gate of degree N, 
the complexity is Q{N). The complexity of evaluating AND-OR formulas that are not "well-balanced" is 
unknown. 

If we allow the use of a quantum computer with coherent oracle access to the input, however, then the 
situation is much simpler; between ri(-\//V) and A^2+°(i) queries are necessary and sufficient to evaluate 
any {AND, OR, NOT} formula with bounded error. In one extreme case, Grover search |Gro96|, IGro02| 
evaluates an OR gate of degree N using 0{\fN) oracle queries and 0(-\/-/Vloglog A^) time. In the other 
extreme case, Farhi, Goldstone and Gutmann recently devised a breakthrough algorithm for evaluating 
the depth-log2 N balanced binary AND-OR formula in 0{y/N) time in the unconventional Hamiltonian 
oracle model |FGG07| . Ambainis [ArnbO? improved this to 0(-\/iV)-queries in the standard query model. 
Childs, Reichardt, Spalek and Zhang |CRSZ07j gave an 0(-\/]V)-query algorithm for evaluating balanced or 
"approximately balanced" formulas, and extended the algorithm to arbitrary {AND, OR, NOT} formulas 
with iV2+°(^) quer ies, and al so A^2+°(i) time after a preprocessing step. (Ref. |ACR+07] contains the merged 
results of |Amb07l IcRSZOT] .^ 

This paper shows other nice features of the formula evaluation problem in the quantum computer model. 
Classically, with the exception of {NAND}, {NOR} and a few trivial cases like {PARITY}, most gate 
sets are poorly understood. In 1986, Boppana asked the complexity of evaluating the balanced, depth-d 
ternary majority (MAJ3) function [SW86] . and today the complexity is only known to lie between il{{7/3)'^) 
and 0((2.6537. . |JKS03| . In particular, the naive generalization of randomized alpha-beta pruning — 
recursively evaluate two random immediate subformulas and then the third if they disagree — runs in expected 
time 0((8/3)'^) and is suboptimal. This suggests that the balanced ternary majority function is significantly 
different from the balanced fc-ary NAND function, for which randomized al pha-beta pruning is known to 
be optimal. In contrast, we show that the optimal quantum algorithm of [C RSZ07 does extend to give 
an optimal 0(2'^)-query algorithm for evaluating the balanced ternary majority formula. Moreover, the 
algorithm also generalizes to a significantly larger gate set S. 
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Organization Wc introduce span programs and explain their correspondence to weighted bipartite graphs 
in Section 2 The correspondence involves considering parts of a span program P as the weighted adjacency 
matrix for a corresponding graph Gp. We prove that the eigenvalue-zero eigenvectors of this adjacency 
matrix evaluate P (Theorem 2.5 1. This theorem provides useful intuition. 

We develop a quantitative version of [Theorem 2.5| in |Scction 3) We lower-bound the overlap of the 
eigenvalue-zero eigenvector with a known starting state. This lower-bound will imply completeness of our 
quantum algorithm. To show soundness of the algorithm, we also analyze small-eigenvalue eigenvectors 
in order to prove a spectral gap around zero. Essentially, we solve the eigenvalue equations in terms of 
the eigenvalue A, and expand a series around A = 0. The results for small-eigenvalue and eigenvalue-zero 
eigenvectors are closely related, and we unify them using a measure we term "span program witness size." 
The details of the proofs from this section are in [Appendix A[ 

applies the span program framework to the formula evaluation problem 



Section 4 



Theorem 4.7 



IS 



our general result, an optimal quantum algorithm for evaluating formulas that are over the gate set S of 



Definition 4.1 and that are adversary-balanced (Definition 4.5 1. The proof of Theorem 4.7 has three parts. 



First, in Section 4.2[ we display an optimal span program for each of the gates in S. Second, we compose the 



span programs for the individual gates to obtain a span program for the full formula ip. This is equivalent to 
joining together the gadget graphs described in Figure 1 to obtain a graph G{if). We combine the spectral 
analyses of the individual span programs to analyze the spectrum of G{'~p) (Theorem 4.161. Finally, this 
analysis straightforwardly leads to a quantum algorithm based on phase estimation of a quantum walk on 



Section 4.4 

[Section 5| concludes with a discussion of some extensions to the algorithm. 



2 Span programs and eigenvalue-zero graph eigenvectors 



A span program P is a certain linear-algebraic way of specifying a function fp . For details on span programs 
applied in classical complexity theory, we can still recommend the original reference jKW93| as well as, e.g., 
the more recent |GP03j . 

Definition 2.1 (Span program). A span program P consists of a nonzero "target" vector t in a vector space 
over C, together with "grouped input" vectors {vj : j € J}. Each Vj is labeled with a subset Xj of the literals 
{xi,xi, . . . ,x„,x^}. To P corresponds a boolean function fp : {0, 1}" — > {0, 1}; defined by fp{x) = 1 (i.e., 
true) if and only if there exists a linear combination fljUj = t such that aj = if any of the literals in 
Xj evaluates to zero (i.e., false). 

Example 2.2. For example, the span program 

Xj 

.0/ 



({a^i} {x2} 



t 



vj 




computes the MAJ3 function. Indeed, at least two of the Vj must have nonzero coefficient in any linear 
combination equaling the target t. Of course, the second row of {vi V2 v^) could be any {a [3 7) with 
0L,f3,^ distinct and nonzero, and the span program would still compute MAJ3. This specific setting is used 



to optimize the running time of the quantum algorithm (Claim 4-9) 



In this section, we will show that by viewing a span program P as the weighted adjacency matrix Aq^ of 
a certain graph Gp, the true/false evaluation of P on input x corresponds to the existence or nonexistence 



of an eigenvalue- zero eigenvector of Agp{x) supported on a distinguished output node (Theorem 2.5) 



In turn, this will imply that writing a span program P for a function / immediately gives a quantum 
algorithm for evaluating /, or for evaluating formulas including / as a gate (Section 4). The algorithm 
works by spectral estimation on Aqp{x). Its running time depends on the span program's "witness size" 



(Section 3 1. For example, if fp{x) is true, then the witness size is essentially the shortest squared length of 
any witness vector (aj)j^j in Definition 2.1 
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Figure 2: The bipartite graph Gp corresponding to span program P (the output edge is (ao, &o), while the 
grouped inputs are ai, . . . , a\j\). 



Remark 2.3. Let us clarify a Jew points in Definition 2.1 



1. It is convenient, hut nonstandard, to allow grouped inputs, i.e., literal subsets Xj possibly with \Xj\ > 1, 
instead of just single literals, to label the columns. A grouped input j can be thought of as evaluating 
the AND of all literals in Xj. A span program P with some \Xj\ > 1 can be expanded out so that all 

\ ^ 1; without increasing '^j\Xj\, known as the size of P. 

2. It is sometimes convenient to allow Xj = 0. In this case, vector Vj is always available to use in the 
linear combination; grouped input j evaluates to true always. However, such vectors can be eliminated 
from P without increasing the size IKW93[ Theorem 7]. 

3. By a basis change, one can always adjust the target vector t to (1,0,0, ... ,0). 



2.1 Span program as an adjacency matrix 

A span program P with target vector t — (1, 0, . . . , 0) corresponds to a certain weighted bipartite graph. 

Notation: For an index sequence H — (hi, . . . , h\H\) ^^nd a set of variables {ah}, let an — (a/i^ , . . . , a/i|^| ). 
For example, vj denotes the sequence of grouped input vectors. It will be convenient to define several more 
index sequences: O ("output"), C ("constraints") and / ("inputs"). Let O and C together index the 
coordinates of the vector space, with O = {1} being the first coordinate, and C the remainder. Let Ij index 
Xi for each j e J, and let / = U^ej ^ disjoint union so |/| = size(P). 

h I J| + \C\ + 2\0\ vertices. Writing the grouped input vectors out 
X)jej A-oj is a 1 X \ J\ matrix row, and Acj is a |C| x \ J\ 

matrix. Let Ajj — J2jeJ iei Ajj encodes P's grouped inputs. Now consider the bipartite graph Gp 

of Figure 2| the upper right block of whose weighted Hermitian adjacency matrix is Aqp . (The adjacency 
matrix is block off-diagonal because the graph is bipartite.) The edges (a^, hi) for j € J and i G Ij are "input 
edges," while {ao,bo) is the "output edge." The input and output edges all have weight one. The weights 
of edges {bo,aj) for j € J are given by Aqj (the first coordinates of the grouped input vectors vj), while 
the weights of edges {be, aj) for c G C, j G J are given by Acj (the remaining coordinates of vj). 



We will construct a graph Gp on \I 
as the columns of a matrix, let ( = 



Example 2.4. For the MAJ3 span program of Example 2. S\ \C\ — 1, |/| = |J| — 3, the graph Gp is shown 
in Figure 1 and the matrix Aqp is 
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2.2 Eigenvalue-zero eigenvectors of the span program adjacency matrix 



Theorem 2.5. For an input x G {0,1}", define a weighted graph Gp{x) by deleting from Gp the edges 
{aj,bi) if the ith literal in Xj is true. Consider all the eigenvalue- zero eigenvector equations of the weighted 
adjacency matrix Aq^^^^, except for the constraint at ao- These equations have a solution with support on 
vertex ao if and only if fp{x) = 1, and have a solution with support on bo if and only if fp{x) = 0. 

Proof. Notation: Use aj,bi,bc,ao,bo to denote coefficients of a vector on the vertices of Gp. Let Ajj{x) 
include only edges to false inputs, i.e., Aij{x) = I]j6j,faiso ieij 
The eigenvalue- A eigenvector equations of Aqp^x) are 



Xbo = ao + Aojaj 
Xbc = Acjaj 
Xbi = Aij{x)aj 
Xao = bo 

Xaj = Aoj^bo + Acj^bc + Aij{x)^bi 



(2.1a) 
(2.1b) 
(2.1c) 
(2.1d) 
(2.1e) 



At A = 0, these equations say that for each vertex, the weighted sum of the adjacent vertices' coefficients 
must be zero. We are looking for solutions satisfying all these equations except possibly Eq. (2. Id) Since 
the graph is bipartite, at A = the a coefficients do not interact with the b coefficients. In particular, 
Eqs. (2.1i,e) (resp. |2.1^ -c) can always be satisfied by setting the b (resp. a) coefficients to zero. 

By scaling, there is a solution with nonzero ao iff there is a solu tion with ao = —1. Then Eqs. (2.1 i,h) 

(;■ 



are equivalent to t 



■ Ac.i 



aj 



ajVj 



Moreover, Eq. (2.1c) implies that aj can be nonzero only if 



grouped input j is true. (If Xj includes any false inputs, then Aij[x) \j) ^ 0, so aj = 0.) These conditions 



and 6o = 1 if and only if fp{x) ~ 0. 



Next, we argue that there is a solution of Eq. (2.1e) with A 
Indeed, 

fp{x) = ^ t ^ Span{wj : j true} ^ t ^ Range [( ^O;^ ) n] 

where 11 = X^truo j b)O I- turn, this holds iff there is a vector w orthogonal to the range and having inner 
product one with t 



-precisely constraint (2.1e) 



with w ■ 



'bo - 
V be ' 



□ 



Remark 2.6. By Theorem 2.5 we can think of the graph Gp as giving a "dual-rail" encoding of the function 
fp: there is a X = Q eigenvector of Gp{x) supported on ao if and only if fp{x) = 1, and there is one supported 
on bo iff fp{x) = 0. This justifies calling edge {ao,bo) the output edge of Gp. 



2.3 Dual span program 

A span program P immediately gives a dual span program, denoted P\ such that fp\{x) — ^fp{x) for all 
X G {0, 1}". For our purposes, though, it suffices to define a NOT gate graph gadget to allow negation of 
subformulas. 

Definition 2.7 (NOT gate gadget). Implement a NOT gate x i-^ x as two weight-one edges connected 
(Figure 1). The edge (ai,bi) is the input edge, while {ao^bo) is the output edge. The middle vertex ai = bo 
is shared. 

At A = 0, the coefficient on ao is minus that on 6j, and = bo by definition. Therefore, this gadget 
complements the dual rail e ncoding of [Theorem 2.5| 

The NOT gate gadget of Definition 2.7 can be used to define a dual span program P^ by complementing 
the output and all inputs with NOT gates, and also complementing all input literals in the sets Xj. Since it 
is not essential here, we leave the formal definition as an exercise. Alternative constructions of dual programs 
are given in |CF02llNNP05] . 
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Figure 3: Graph for MAJ3(xi, a;2, MAJ3(a;3, X4, X5)), with input edges labeled by the associated literals. 
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Example 2.8. For distinct, nonzero a, [3,^, the span program 

Xj = {%% {5JT} {x^} {x^}) 




1 



computes ^ MAJ3(xi, X2, X3). It was constructed, by adding NOT gate gadgets, as the dual to the span 
program in \Example 2.S\ up to choice of weights. 

2.4 Span program composition 

Definition 2.9 (Composed graph and span program). Consider span program Q on {0, 1}" and programs Qi, 
i G [n] = {1, . . . ,n\, with corresponding graphs Gq and Gq.. The composed graph is defined by identifying 
the input edges of Gq with the output edges of copies of the other graphs. If an edge corresponds to input 
literal Xi, then identify that edge with the output edge of a copy ofGq.; and if an edge corresponds to Tl, then 
insert a NOT gate gadget (i.e., an extra vertex, as in Definition 2.1) before a copy of Gq-. The composed 



span program, denoted Qo (5[„]. is the program corresponding to the composed graph (i.e., Gqoq^^-^ is the 
composed graph). Thus /qoQ[„j = fq ° fq^-^] ■ 

Definition 2.10 (Formula graph and span program). Given span programs for each gate in a formula (p, 
span program P{(p) is defined as their composition according to the formula. Let G{ip) be the composed graph, 
G{if>) = G'p(^). 

Example 2.11. For example, the span program 

X,j = ({xi} {x^} {X3} {X4} {x^}) 



t = 



is a composed span program that computes the function MAJ3(2:i, X2, MAJ3(x3, 0:4, 2:5)), provided a, (3,^ are 
distinct and nonzero. (See Example 2.^ ) Figure 3 shows the associated composed graph. 
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Example 2.12 (Duplicating and negating inputs). To the left in Figure 4 is the composed graph for the 
formula MAJ3(a;i,X2,X3)®a;4 = EQUAL 2 ( MA J 3 ( x [3] ) , xX ) , obtained using the substitution rules of Figure 1 



(A span program for PARITY will be given in Lemma 4. 12 ) Note that we are effectively negating some inputs 
twice, by putting NOT gate gadgets below the negated literals xl, X2, a^- This is of course redundant, and is 
only done to maintain the strict correspondence of graphs to span programs, as in \Example 2.8\ by keeping 
the input vertices bj at odd distances from gq. 

To the right is the same graph evaluated on input x ~ 1100, i.e., with edges to true literals deleted. Since 
the formula evaluates to true, \Theorem 2. 5\ promises that there is a X ~ eigenvector supported on ap. In 
this case, that eigenvector is unique. It has support on the black vertices. 
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Figure 4: Graph for MAJ3(a;i, X2, xy) © a;4, and its evaluation on input x ~ 1100. 



3 Span program witness size 



In Section 2| we established that after converting a formula (p into a weighted graph G{ip), by replacing each 



gate with a gadget subgraph coming from a span program, the eigenvalue-zero eigenvectors of the graph 
effectively evaluate ip. The dual-rail encoding of ip{x) = fp{ip){x) promised by Theorem 2.5 will suffice to 
give a phase-estimation-based quantum algorithm for evaluating ip. The goal of this section is to make 
[Theorem 2.5| more quantitative, which will enable us to analyze the algorithm's running time. 

In particular, we will lower-bound the achievable squared support on either ao or bo of a unit-normalized 
A = eigenvector. This will enable the algorithm to detect if ip{x) = 1 by starting a quantum walk at ao', 
if pi^x) = 1, then \ao) will have large overlap with the A = eigenvector. 

We also study eigenvalue-A eigenvectors of Gp(^)(a;), for |A| ^ sufficiently small. At small enough 
eigenvalues, the dual-rail encoding property of [Theorem 2.5| still holds, in a different fashion. Note that 
since the graph is bipartite, we may take A > without loss of generality. For small enough A > 0, it will 
turn out that the function evaluation corresponds to the output ratio ro = ao/bo- If fp{x) = 1, then ro is 
large and negative, roughly of order — 1/A. If fp{x) — 0, then ro is small and positive, roughly of order A. 
Ultimately, the point of this analysis is to show that if the formula evaluates to false, then there do not exist 
any eigenvalue-A eigenvectors supported on ao for small enough |A| ^ 0. This spectral gap will prevent the 
algorithm from outputting false positives. 

Consider a span program P. Let us generalize the setting of [Theorem 2.5| to allow P's inputs to be 



themselves span programs, as in Definition 2.9 Assume that for some x, every A € [0,A) and each input 
i € I, we have constructed unit-normalized states |'0i(A)) satisfying the eigenvalue- A constraints for all the 
ith subgraph's vertices except a^. 

Definition 3.1 (Subformula complexity). At \ = 0, for each input i G Ij, let ai denote j'i/'i) 's squared 
support on either aj or bi, depending on whether the input evaluates to true or false, respectively. 

For A > 0, assume that the coefficients of along the ith input edge are nonzero, and let Vi = aj/bi 
be their ratio. If the literal associated to input i evaluates to false, then let Sj = rj/A; if it is true, then let 
Si = -l/{riX). 

For an input i €z I, its subformula complexity is 

Zi — maxmax< 1/(7^, sup Si > . (3.1) 
^ \ Ae(0,A) J 

For example, if Zi is small, then \il)i(Q)) has large support on either Oi or bi. In general, Zi > 1. If input i 
corresponds to a literal and not the output edge of another span program, then Zi = I. 

We construct a normalized state \ipoW) that satisfies all the eigenvalue-A eigenvector constraints of the 



composed graph, except Eq. (2. Id) at oq. We construct \ipo) by putting together the scaled \ipi)s and also 
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assigning coefficients to the vertices in Gp. Similarly to Eq. pi)] define 



zo{x) = max < 1/ao, sup sq > , (3.2) 

[ Ae(0,A) J 

where ao is the squared support of \ipo{0)) on ao or bo, and, for X> 0, sq is — l/(roA) or ro/A if f{x) is 



true or false, respectively. We will relate zq = niax^; zo{x) to the input complexities zj (Theorem 3.7 1. 

First of all, notice that if > 1, then several of the input subgraphs share the vertex aj. They must 
be scaled so that their coefficients at aj all match, motivating the following definition. 

Definition 3.2. The grouped input complexity o/j G J on input x is 

{max <^ y^icr Zi,l> if j evaluates to true 
, ^^"'^ (3.3) 
(E/aise ,e/, ) Otherwise 

Recall that grouped input j evaluates to true iff all inputs in Ij are true. (In the first case, we take the 
maximum with 1 to handle the case Ij — 0.j 

When i is false, some input i E Ij is false, so the coefficient at a, must be set to zero at A = 0. However, for 



each false i & Ij, can be scaled arbitrarily. The definition in Eq. (3.3) comes from choosing scale factors 
fi in order to maximize the sum of the scaled coefficients on the vertices bi , under the constraint that the 
total norm be one, X^ig/ = 1- 

A few more definitions are needed to state [Theorem 3.71 

Definition 3.3 (Asymptotic notation). Let a < b mean that there exist constants ci,C2 such that a < 
C\ + 6(1 + C2IAI maxi z^). 

Definition 3.4 (Matrix notations). For a given input x, let n(x) = X^true j b)(j | ^ projection onto the 
true grouped inputs, Il{x) = 1 — n(a;), and z(x) — "^j Zj{x)\j){j\ a diagonal matrix of the grouped input 
complexities. To simplify equations, we will generally leave implicit the dependence on x, writing H, li and 
z. Let A — (^°' ) = Xj 'with columns the vectors \vj). 

Definition 3.5 (Moore-Penrose pseudoinverse). For a matrix M, let Af+ denote its Moore-Penrose pseu- 
doinverse. If the singular-value decomposition of AI is M — Xfc with all mf^ > and for sets 

of orthonormal vectors {\k)} and {\k')}, then M+ = J2k'^k^W)i^\- ^"^^ that MM+ = J2k I^X^I 
projection onto M 's range. 

Definition 3.6 (Span program witness size). For span program P and input subformula complexities zj, 
the witness size of P is wsize(P) — max^; wsize(P, x), where for an input x, wsize(P, x) is defined as follows: 

• If fp{x) = 1, then \t) g Range(y4n), so there is a witness \w) G C'"'' satisfying yHIIui) = \t). Then 
wsize(P, x) is the minimum squared length, weighted by z{xY^^, of any such witness: 

wsize(P,a;)= min \\S'^^^\w)f (3.4) 

\w):An\w) = \t) 

= ||(Ani-i/2)+|t)||2 . 

• If fp{x) — 0, then \t) ^ Range(j4n). Therefore there is a witness \w') g Cl'-^'^'^ satisfying {t\w') — 1 
and UA^\w') 0. Then 

wsize(P,x)= min \\S^/^A^\w')\\^ (3.5) 

\w'):{t\w')=l 

nA^\w')=o 

= ||(l + (n(Azi/2)+Azi/2_i)+n)(Azi/2) + |i)||-2 ^ 
the inverse squared length of the projection of {Az^^^)^\t) onto the intersection ofH andIia,nge{z^^^A^). 
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By \wr^), resp. \w'^), we denote a witness for input x achieving the minimum in Eq. \(34]\ resp. \(3J) 



The span program witness size is easily computed on any given input x. Lemma A. 3| below will give two 
alternative expressions for wsize(P, x). Now our main result is: 

Theorem 3.7. Consider a constant span program P. Assume that Azi < e for a small enough constant 
e > to be determined and for all i I . Then 



zo{x) < wsize(P, x) 



(3.6) 



For A = 0, Eq. (3.6) says that the achievable squared magnitude on gq or bp of a normalized eigenvalue- 
zero eigenvector is at least l/wsize(P, x), up to small controlled terms. For A > 0, Eq. (3.6)| says that the 
ratio ro = ao/bo is either in (0, wsize(P, a:)A] or (— oo, — l/(wsize(P, a:)A)], up to small controlled terms, 
depending on whether fp{x) is false or true. 



Proof sketch of Theorem 3. 7 At A = 0, the proof of Theorem 3.7| is the same as that of Theorem 2.5 except 
scaling the inputs so as to maximize the squared magnitude on ao or bo- This maximization problem 



is essentially the same as the problems stated in Definition 3.6 (up to additive constants). The explicit 
expressions for the solutions follow by geometry. 



For A > 0, we solve the eigenvalue equations (2.1 i,b,e) by inverting a matrix and applying the Woodbury 
formula. We argue that all inverses exist in the given range of A. We obtain 



ro = ao/bo = A + (o|f |o) + \{o\fAcyX Mcjr|o) 



where |o) = Aoj , f = ~\s 11 + AsII (with s defined from s similarly to how z is defined from z), and 
X = Acjs'^^I\-Acj^—\^AcjsYiAcj^—\^- The largest term in X, Acjs~^IiAcj\ is only invertible restricted 
to its range, A = Ac jIi-{Ac jH)^ ■ Therefore, we compute the Taylor series in A of the pseudoinverse of 
AXA and of its Schur complement, (X/( AXA)), separa tely, and then recombine them. The lowest-order 
term in the solution again corresponds to [Definition 3.6 (if fp{x) is false, the 1/A term is zero), and we 
bound the higher-order terms. □ 



The full proof of [Theorem 3.7| is given in [Appendix A[ 

Remark 3.8. In case fp{x) — 0, A^jw') appears also in the "canonical form" of the span program P lKW93f . 

The above analysis of span programs does not apply to the NOT gate, because the ability to complement 
inputs was assumed in [Definition 2.1[ Implementing the NOT gate x i-^ x with a span program on the literal 
X would be circular. Therefore we provide a separate analysis. 

Lemma 3.9 (NOT gate). Consider a NOT gate, implemented as two weight-one edges connected as in 



Definition 2.7 Assume |A| < l/(\/2zi). Then zo ^ Zi 



Proof. Analysis at X = 0. If the input is true, then ai measures the squared support on of a normalized 
A = eigenvector. Then ao = en, since = bo the output vertex. If the input is false, so bi — ^/oi, then 
bi + ao — 0. Therefore, we simply need to renormalize: ao — ai /{I + ai), or equivalently — + 1. 

Analysis for small A > 0. We are given = ai/bi. The eigenvector equation is bi + ao — Aa; = Xbo. 
Therefore, ro = ao/bo = A — l/r^. If the input is false, so Si = ri/\, then so = — l/(Aro) = 5^/(1 — X^s/). 
Therefore, Si < so < Si(l -I- 2A^Si) since X^Si < 1/2. If the input is true, so Si = — l/(A7'i), then so — 
ro/\ = Si -f 1 . 

Therefore zo ^ Zi as claimed. Note that w.l.o.g. we may assume there are never two NOT gates in a row 
in the formula (p, so the additive constants lost do not accumulate. □ 



9 



4 Formula evaluation algorithm 



In Section 4.1 we specify the gate set S ([Definition 4.1 1 and define the correct notion of "balance" for a 



formula that includes different kinds of gates (Definition 4.5 1. These two definitions allow us to formulate 



the general statement of our results, [Theorem 4.7 of which Theorem 1.1 [ is a corollary. 



In |Section 4.2| we present span programs of optimal witness size for each of the gates in S. [Theorem 4.16| in 



[Section 4.3 plugs together the spectral analyses of the individual span programs to give a spectral analysis of 



G{ip). Finally, we sketch in Section 4.4 how this implies a quantum algorithm, therefore proving Theorem 4.7 



4.1 General formula evaluation result 
Definition 4.1 (Extended gate set S). Let 



S' 



arbitrary 1-, 2-, or 3-bit gates, 
0{l)-fan-in EQUAL gates 

0{l)-size {AND, OR, NOT, PARITY} ] (4.1) 
5 = ^ read-once formulas composed onto 
the gates from S' 

Example 4.2. The gate set S includes simple gates like AND, as well as substantially more complicated 
gates like MAJ3(a;i, a;2, xa) A {x^ ® 2:5 © • • • © Xk-i © {xk V Xk+i)), provided k — 0(1). It does not include 
gates from S' composed onto gates from S : for example MAJ3(a;i, X2 © X3, X4 A x^) ^ S. 

To define "adversary-balanced" formulas, we need to define the nonnegative- weight quantum adversary 
bound. 

Definition 4.3 (Nonnegative adversary bound). Let f : {0, l}'^ ^ {0, 1}. Define 

lirii 

Adv(/) = max ^-^ n- , (4.2) 

r>o max, ToDJ ' ^ ' 

where T o Di denotes the entrywise matrix product between T and Di a zero- one-valued matrix defined by 
{x\Di\y) = 1 if and only if bitstrings x and y differ in the ith coordinate, for i G {1, . . . , fc}. The maximum 
is over all 1^ x 1^ symmetric matrices F with nonnegative entries satisfying (x\V\y) = if f{x) = f{y). 

The motivation for this definition is that Adv(/) gives a lower bound on the number of queries to the 
phase-flip input oracle 

:|&,i)^(-l)'""'N) (4.3) 

required to evaluate / on input x. 

Theorem 4.4 (Adversary lower bound |Amb06al IBSSOS] ). The two-sided e-bounded error quantum query 
complexity of function f, Qdf), is (it least - — '^^^^^ '^^ Adv(/). 

To match the lower bound of Theorem 4.4[ our goal will be to use 0{Adv{tp)) queries to evaluate ip. 



Definition 4.5 (Adversary-balanced formula). For a gate g in formula ip, let ipg denote the subformula of 
if rooted at g. Define ip to be adversary-balanced if for every gate g, the adversary lower bounds for its input 
subformulas are the same; if g has children hi, . . . , hk, then Adv{iphi) = ■ ■ ■ = Adv((/7/i^). 



Definition 4.5 is motivated by a version of an adversary composition result |Amb06a1 IHLS07] : 

Theorem 4.6 (Adversary composition |HLS07| ). Let f = g ° {hi, . . . , hk), where Adv(/ii) = • • • = Adv{hk) 
and o denotes function composition. Then Adv(/) = Adv(g)Adv(/ii). 
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Figure 5: Binary gates on up to three bits. Up to equivalences — permutation of inputs, complementation of 
some or all inputs or output — there are fourteen binary gates on thre e inputs xi , X2 , X3 . Adv ersary bounds 
Adv(/) for all functions / on up to four bits have been computed by |HLS06j , and see |RS07 . 



If ip is adversary-balanced, then by Theorem 4.6 Adv^Lpg) is the product of the gate adversary bounds 



along any non-self-intersecting path x from g up to an input, Adv{ipg) = H/igx ^'^^W- Note that Adv(^/) = 
Adv(/), so NOT gates can be inserted anywhere in an adversary-balanced formula. 
The main result of this paper is 

Theorem 4.7 (Main result). There exists a quantum algorithm that evaluates an adversary-balanced formula 
ip{x) over S using 0{Adv{(p)) queries to the phase-flip input oracle O^- After efficient classical preprocessing 
independent of the input x, and assuming 0{\)-time coherent access to the preprocessed classical string, the 
running time of the algorithm is Adv((^)(log Adv((y5))'^(^\ 



From Figure 5 the adversary bound Adv(MAJ3) = 2. By Theorem 4.6 the adversa ry bound for the 



balanced MAJ3 formula of depth d is 2'^. [Theorem l.l| is therefore essentially a corollary of Theorem 4.7 (for 
the balanced MAJ3 formula, coherent access to a preprocessed classical string is not needed) . 

4.2 Optimal span programs for gates in S 

In this section, we will substitute specific span programs into [Definition 3?6l in order to prove: 

Theorem 4.8. Let S he the gate set of\Definition 4-i For every gate / G 5, there exists a span program P 



computing fp = f, such that the witness size of P {Definition 3.6) on equal input complexities Zi — 1 is 

wsize(P) = Adv(/) . (4.4) 



Adv(/) is the adversary bound for f {Definition 4-3). 



Proof. We analyze five of the fourteen incquivalent binary functions on at most three bits, listed in Figure 5 



and Xl (both trivial), the MAJ3 gate (Claim 4.9 1, the fc-bit EQUALfc gate (Claim 4.101, and a certain 
three-bit function, ^(x) = (xi A X2 A X3) V (xl A X2) (Claim 4.11 1. 



Claim 4.9. Let Pma.Is be the span program from Example 2.2 Then wsize(PMAj3) = 2 = Adv(MAJ3) 



Proof. Substitute PmaJs into Definition 3.6 Some of the witness vectors are Iwqqq) = (1,0), Iwiqq) = 



(l,-l/\/3), and |u;iio) = (e— >:^^^7^;0)7kiii> = (l,l,l)/\/3. 
Claim 4.10. Letting a — \/k — 1, the span program 

Xj = ({xi,X2, 

t = (1) , vj = { c 
computes EQUAL^, with witness size 



□ 



,Xfc} {xi,X2, . . . ,Xfc}) 
) 

Adv(EQUALfe)ji] 



^The optimal adversary matrix F comes from the 2 X 2fc matrix (J^!!! ii'-)' where the rows correspond to inputs O'' and 
1'', and the columns correspond to inputs of Hamming weight 1 then A; — 1, and a = l/(fc — 1). 
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Proof. Substitute into Definition 3.6 The witnesses are \wQk) = (O, \wik) = (^,0) and \w'^) = (1) for 
a;^{0^l'=}. " " □ 

Claim 4.11. Let g{x) = {xi A X2 A 2:3) V {xi A X2). Letting ol\ — ^\ + and a2 — \/ \Pi — 1 , the span 
program 

Xj = ({xi,X2} {x{,x^} {xs}) 
, f l\ ( cti a\ai 

*=UJ' "'^l «2 1 

computes g with witness size TsTTs- Adv(g)g 

Proof. By substitution into [Definition ^TH] □ 



For all the remaining gates in S, it suffices to analyze the NOT gate (Lemma 3.9 1, and OR and PARITY 
gates on unbalanced inputs (Lemma 4.12). That is, we allow zi and Z2 to be different, with zi/ Z2, Z2/ zi = 
0(1). For functions b and b' on di sjoint inputs, Adv(6 b') = Adv(6) + Adv(6'), and Adv(6 V b') = 
i/Adv(6)2 + Adv(6')2 [BS041 IkLSOT] ; we obtain matching upper bounds for span program witness size. 

Lemma 4.12. Consider f{x, x') = f'{b{x),b'{x')), with f e {PARITY, OR}, and b and b' functions on 0(1) 
bits. Assume that there exist span programs Pb and Pb' for b and b' with respective witness sizes B = wsize(Pf,) 
and B' — wsize(Pb/). Then there exists a span program P for f with witness size wsize(P) — B + B' if 
f = PARITY, or ^B^ + B'^ if f = OR. 



Proof. Substitute the following span programs with zero constraints into [Definition 3.6 



Xj^{{xi,X2} {xi,X2}) 

^PARITY : i = (1) , vj = { 1 1 ) , 

Xj={ {Xi} {X2} ) 

FoR:i=(l), v., ^ [^^f^ ^ ^B''^ ) ■ 

The witness vectors for PARITY are \w'q^) = (1) and \wiq) — {^/ B^ + B'^, 0), and the witness vectors for 
OR are {w'^^) = (1), \wio) - {</ B^ + B'^ ,0), and l^n) = (1,1) ■ ^x^W^B^. □ 



Then, e.g., the function EXACT2 ot 3(2^1, 2:2, 2^3) — MAJ3(xi, X2, xa) A (xi V X2 V X3), so 



Lemma 4.12 



implies a span program for EXACT2 of 3 with witness size \/7 — \J wsize(MAJ3)^ + wsize(0R3)^. □ 

Remark 4.13. Our procedure for analyzing a function f has been as follows: 

L First determine a span program P computing fp = f. The simplest span program is derived from the 
minimum-size {AND, OR, NOT} formula for f . 

2. Next, compute wsize(P, x) for each input x, as a function of the variable weights of P. 

3. Finally, optimize the free weights of P to minimize wsize(P) — max^; wsize(P, x). For example, note 
that scaling Aqj up helps the true cases in \Definition 3.6\ and hurts the false cases; therefore choose 
a scale to balance the worst true case against the worst false case. 

We respect the symmetries of f during optimization. On the other hand, if two literals are not treated 
symmetrically by f, then we do not group them together in any grouped input Xj. For example, in 
\Claim 4-1 A "we do not group X3 together with xi and X2 in Xi. 



^The optimal adversary matrix F comes from the matrix 



(1 a V3\ / , N 1/2 / 

ia^j,wherea= (5 - V 13 - 6v^) j ,b = |(^-l-v^ + 



y^2(8^|-^\/i^^ I and the rows correspond to inputs Oil, 101, 110, the columns to inputs 000, 001, 111. 
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Remark 4.14. The proof of Theorem ^.8 uses separate analyses for EQUAL^., MAJ3 and g because the 
upper bounds from Lemma 4^.1^ for these functions do not match the adversary lower bounds. For example, 
from Figure 5 the smallest {AND, OR, NOT} formula for MAJ3 has five inputs, MAJ3(a;[3]) = {xi A X2) V 
{{xiV X2) ^xz) . Lemma 4-12 therefore gives a span program P for MAJ^ with witness size wsize{P) = ^/b . Ln 
fact, optimizing the weights of this P gives a span program with witness size the worst-case 

inputs of the read-once formula {xi A X2) V {{xa V x^,) A cca) do not arise under the promise that X4 = Xi and 
= X2- However, this is still worse than the span program PmaJs of Example 2.2 with wsize(PMAj3) = 2. 

Remark 4.15. Lemma 4-12 implies that any {AND, OR, NOT} formula of bounded size has a span program 



with witness size the square root of the sum of the squares of the input complexities. We conjecture that this 
holds even for formulas with size u (1); see IAmM6b[\TCR+0'^ for special cases. 



4.3 Span program spectral analysis of 

Theorem 4.16. Consider an adversary-balanced formula ip on the gate set S , with adversary bound Adv(93). 
Let P be the composed span program computing fp = (p. For an input x € {0, 1}^, recall the definition of 
the weighted graph Gp{x) from Theorem 2.5\ if the literal on an input edge evaluates to true, then delete 



that edge from Gp. Let Gp{x) be the same as Gp{x) except with the weight on the output edge {ao,ho) set 
to w = e^/ Adv(ip) (instead of weight one), where e^, > is a sufficiently small constant. Then, 



Lf ip{x) = 1, there exists a normalized eigenvalue- zero eigenvector of the adjacency matrix A^^ 
ri(l) support on the output vertex ao. 



(x) 



with 



If ^{x) = 0, then for some small enough constant e > 0, Agp{x) does not have any eigenvalue-X 
eigenvectors supported on ao or bo for \X\ < e/Adv{ip). 



Proof. The proof of Theorem 4.16 has two parts. Fu'st, we will prove by induction that Zg = 0{Adv{tpg)). 
Then, by considering the last eigenvector constraint, Xao = who, we either construct the desired eigenvector 
or derive a contradiction, depending on whether (p{x) is true or false. 

Base case. Consider an input Xi to the formula Lp. li Xi — \, then the corresponding input edge (oj, bi) is 
not in Gp{x). In particular, the input i does not contribute to the expression for Zj{x) in Eq. (3.3) so 

0, then the input edge (a^, bi) is in Gp{x). The eigenvalue-A equation at bi is 



may be left undefined. If Xi 



Qj. For A 



0, this is just aj = 0, so let at = 1. For A > 0, this is r.; = Xsi = aj /bi = A, so Si = Zi = 1. 



Induction. Assume that |A| < e/Adv((y9), for some small enough constant e > 0. 

Consider a gate g. Let hi, . . . ,hk be the inputs to g. Let denote the subformula of based at g. By 
Theorem 3.7 and Theorem 4.8| the output bound Zg satisfies 



< 



Ady^g) max Zh^ 



(4.5) 



or equivalently 



Zg <ci+ Adv(5)(maxz,iJ(l + C2 • |A|Adv((y5g)) 



(4.6) 



for certain constants Ci, C2. Different kinds of gates give different constants in Eq. (4.6) but since the gate 
set is finite, all constants are uniformly 0(1). 



Since |A| < e/Adv((^), the recurrence Eq. (4.6) has solution 



< 



oi max Jl Adv(/i)(l 



, AdY{tph) \ 

' Adv((^) / 



where the maximum is taken over the choice of x a non-self-intersecting path from g up to an input. Because 

Also, 



ip is by assumption adversary balanced (Definition 4.5), Ilhex^^^^^-^ 



; Adv(yh) N 
Adv(ip) ' 



0(1). Therefore, the solution satisfies 



Zg = 0(Adv(^g)) 



(4.7) 



13 



Final amplification step. Assume ip{x) — 1. Then by Eq. (4.7) there exists a normahzed eigenvalue- 
zero eigenvector of the graph Gp{x) with squared amphtude 

hop > CTo = l/0(Adv(y))). Recall that 
w — twi \/ Adv((p) is the weight of the output edge (ao, ho) of P in Gp{x), and let ao = wao- The A = 
eigenvector equations for Gp{x) are the same as those for Gp{x), except with ao in place of ao- Therefore, 
we may take |aop — l/0(Adv((p)), so for a normalized eigenvalue-zero eigenvector of Gp{x), |aop = 
By reducing the weight of the output edge from 1 to w, we have amplified the support on ao up to a constant. 
Now assume that ip(x) ~ 0. By iThcorcm 2.5 there does not exist any eigenvalue-zero eigenvector 

by the constraint Xao = who- For A ^ 0, |A| < e/Adv 

< 



ip{x) ~ 0. By Theorem 2.5 
sup ported on ao- Also 6o = at A 

Eq. (4.7) implies that in any eigenvalue-A eigenvector for Gp{x), either ao — bo — or the ratio \ao/bo\ 
|A| •0(Adv((/j)), so 

\ao/bo\ < C3 • ^Adv(^) (4.8) 



for some constant C3 that does not depend on w- 
Xao ~ wbo- Combining this equation with Eq. (4.S 



w — twi \J Adv(93), this is a contradiction provided we set e^, so > cse 
of Gp(x) cannot have an eigenvalue-A eigenvector supported on ao or be 



We have not yet used the eigenvector equation at ao, 
we get ix? < C3A^Adv((/j) < C3e^/Adv(iy9). Substituting 
Therefore, the adjacency matrix 

□ 



4.4 Quantum algorithm 



We apply [Theorem 4.16| and the Szegedy correspondence between discrete- and continuous-time quantum 
walks [ Sze04 _ to design the optimal quantum algorithm neede d to prove Theorem 4.7 The approach is similar 



to that used for the NAND formula evaluation algorithm of [CRSZ07], with only technical differences. Full 
details are given in [Appendix B[ 

The main idea is to construct a discrete-time quantum walk Ux = OxUqn on the directed edges of Gp 
whose spectrum and eigenvectors correspond exactly to those of Aq Here Uqn is a fixed unitary operator 



only depending on the formula graph A^^ 
input X, and is defined by 



(0") 



Gp(x)- 

which can be implemented efficiently without access to the 



Ox\v,w) = 



(— 1)^*('') jw, w) if w is a leaf 
\v,w) otherwise 



(4.9) 



where i{v) is the index of the input variable corresponding to the leaf v- One call to Ox can be implemented 
using one call to the standard phase-flip oracle Ox of Eq. |(4.3) 



Now starting at the output edge \ao,bo), run phase estimation |CEMM98] on Ux with precision 6p — 
0(1/Adv(iy9)) and error 5e a small enough constant. Output ^^ip{x) = 1" iff the output phase is zero. 
The query complexity of this algorithm is 0{l/5p) — 0(Adv(i/3)). The first part of Theorem 4.16 implies 
completeness, because the initial state has constant overlap with an eigenstate of Ux with phase zero. The 



second part of Theorem 4.16 implies soundness, because the spectral gap away from zero is greater than the 
precision 5p- 



5 Extensions and open problems 

Theorem 4.7| can be extended in several directions, and there are many open problems including those 
from [CRSZ07 . For example, is the eigenvalue-zero eigenstate useful for extracting witness information? We 
would like to raise several other questions. 

5.1 Four-bit gates 

The gate set S includes all three-bit binary gates. What about four-bit gates? Up to symmetries, there are 
208 inequivalent binary functions that depe nd on exactly four input bits xi, - - - ,Xi- The functions we have 
considered so far are listed at the webpage |RS07j . To summarize. 
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Thirty of the functions can be written as a PARITY or OR of two subformulas on disjoint inputs. 



These functions are already included in the gate set S (Definition 4.11 



• For 25 additional functions, we have found a span program with witness size matching the adversary 
lower bound. These functions can be added to S without breaking [Theorem 4.7| 

• For 20 of the remaining functions, we have found a span program with complexity beating the square- 
root of the minimum {AND, OR, NOT} formula size, but not matching the adversary lower bound. 



Example 5.1 (Threshold 2 of 4). In analogy to Example 2.S\ one might consider the span program 



Xj = {{xi} {x2} {a^s} {2^4}) 
/ 1 1 1 1 

Oy ' "'^ ^ U ^ -I -^ 

This span program computes Threshold2 of 4{x[i]) — MAJ3 is Threshold2 of 3 — but it is not optimal. Intu- 
itively, the problem is that the different pairs of inputs are not symmetrical. An optimal span program, with 
witness size \/6, is 

Xj = ({a^i} {X2} {X2} {xs} {xg} {X4} {X4}) 
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It was derived by embedding a four-simplex symmetrically in the 2x2 unitary matrices, in correct analogy 
to \Example 2.2 This embedding gives a span program over an extension ring of C that, following \KW93[ 



Theorem 12] and ! BGW99, Prop. 2.8], can be simulated by a span program over the base ring. 
The Hamming- weight threshold functions Threshold/j offc '■ {0,1}'" {0,1} defined by 

Threshold, of = I J |f J J 

are functions that we currently have an understanding of only for h € {0, 1, fc} and a partial understanding of 



for h G {2, k — 1}. Another function of particular interest is the six-bit Kushilevitz function H LS07| [ Amb 06a . 
It seems that fc-bit gates are inevitably going to require more involved techniques to evaluate optimally, for 
k large enough. It may well be that four-bit gates are already interesting in this sense. 

5.2 Unbalanced formulas 

Can the restriction that the gates have adversary-balanced inputs be significantly weakened? So far, we have 
only analyzed the PARITY and OR gates for unbalanced inputs, in Lemma 4.12[ For the MAJ3 gate, we 



have found an optimal span program for the case in which only two of the inputs are balanced: 

Lemma 5.2. Let f{x,x',x") = MAJ3{b{x),b'{x'),b"{x")) with b,b',b" functions on 0(1) bits computed 
by span programs Pb, Pf , Pb" with witness sizes B = wsize(P(,) = Adv(6) = wsize(Pb') = Adv(6') and 
B" = wsize{Pb") = Adv{b"). Let (3 = B" / B and a = ^(VsTTS^ - /3)i/2, Then there exists a span 

program P for f with wsize(F) = i(y8T^ + /3)S = Adv(/); 

Xj = ({xi} {X2} {X3} ) 
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Therefore, for example, the four-bit gates MAJ3(a;i, X2, X3 A X4) and MAJ3(a;i, X2-, X3 ® X4) can be added 
into S without affecting the correctness of Theorem 4.7 (see [Section 5.1 1. However, we do not have an 
understanding of MAJ3 when all three input complexities differ. In this case, the formula for the adversary 
lower bound is substantially more complicated, and we do not have a matching span program. 

For other gates, with the exception of PARITY and OR, we know similarly little. For a highly unbalanced 
formula with large depth, there is the further problem o f whether the formula can be rebalanced without 
increasing its adversary lower bound too much [CR.S ZOT) . 



5.3 Witness vectors and the adversary bound 



The witnesses in |Definition 3^ have an interesting property related to a dual version of the adversary 



bound [LM041ISS06]: Assume that all \Xj\ = 1 and z = 1. For a:,?/ £ 10,1 1" with fp{x) = 1, fp{y) = 



consider the witnesses Iw^ 



achieving the minima in Eqs. (3.4) (3.5) 



\wx) = U{x)\wx} and II{y)\wy) = \wy 



and let 



A^w'y). Then 



so 



{w,\n{x)U{y)\wy) = {w.M^\w') = {t\w[ 



Therefore, if we define Pxii) = 



P Ej: X,={x,} 
y Xj={x-} 



I0> 



for each x (for both true and false fp{x)) and for 



i G [nj, 
bound 



then we get a feasible set of probability distributions for the minimax formulation of the adversary 
SS06j . If wsize(P) = Adv(/p), then this set of probability distributions is optimal. 



In this paper, we onl y use the adversary bound with nonnegative weights Adv(/). In fact, Hoyer, Lee and 
Spalek showed that Eq. (4.2) still provides a lower bound on the qua ntum query complexity even when one 



removes the restriction that the en tries of F be nonnegative |HLS07 . This more general adversary bound 



Adv (/) is clearly at least Adv(/). Theorem 4.6 is not known to hold for Adv composition; however, under 



the conditions of the theorem, it is known that Adv (/) > Adv (g) Adv (hi) . For every three-bit function 
/, no advantage is gained by allow ing nega tive weights: Adv*(/) — Adv(/). For most functions / on four 



bits, though, Adv^(/) > Adv(/) |HLS06 . Therefore, one gets an asymptotically higher lower bound for 



formulas with such functions as gates than using Adv. However, for no function / with Adv(/) < Adv (/) 
do we have a span program that matches Adv*(/). The dual formulation of Adv* cannot be expressed 
using probability distributions and one therefore cannot hope for a simple correspondence with the witnesses 
like described above. 

Both variants of the adversary bound, Adv and Adv* , can be expressed as optimal solutions of certain 
semidefinite programs. Can one find a semidefinite formulation of span program witness size? 



5.4 Eliminating the preprocessing 

In many cases for ip, the preprocessing step of algorithm ACQ can be eliminated. Because ip is an adversary- 
balanced formula on a known gateset, a decomposition through [Theorem B.4| can be computed separately 
for each gate of S and then put together at runtime. This decomposition is not the decomposition of 
Claim B.2 which involves g lobal properties of ip like For an example, see the exactly balanced NAND 



tree algorithm in [CRSZ07 



The decompositions can be combined because all the weights of gate i nput /out put edges are one. This 

in which the weight of 



is quite different from the case of unbalanced NAND trees considered by |CRSZ07 
an input edge depends on the subformula entering it. 



5.5 Arbitrary {AND, OR, NOT, PARITY} formulas 

Some of the conditions on the gates in S ( [Definition 4.1| can be loosened. For example, S includes as single 
gates 0(l)-size {AND, OR, NOT, PARITY} formulas on inputs that are themselves possibly elements of 5'. 
Let / be such a gate, f = g o {hi, . . . ,hk) with g an {AND, OR, NOT, PARITY} formula of size 0(1), and 
each hi either the identity or a gate from iS'. We have assumed that all the inputs to / have equal adversary 
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bounds. However, the stated proof works equally well if only each hi has inputs with equal adversary bounds, 
provided the inputs to hi and to hi' have adversary bounds that differ by at most a constant factor. 

We beheve that t he assum ption that g be of size 0(1) can also be significantly weakened. A stronger 
analysis like that of ' CRSZO?] for "approximately balanced" {AND, OR, NOT} formulas can presumably 
also be applied with PARITY gates. We have avoided this analysis to simplify the proofs, and to focus on 
the main novelty of this paper, the extended gate sets. 

For {AND, OR, NOT, PARITY} formulas that are not "approximately balanced," rebalancing will 
typically be required. We have not investi gated how the formula rebalancing procedures of |BCE91| IBB94j 
affect the formula's adversary bound. In CRSZ07I . it sufficed to consider the effect on the formula size, 
because the adversary bound for any {AND, OR, NOT} formula on N inputs is always ^/N. 

5.6 New algorithms based on span programs 

We have begun the development of a new framework for quantum algorithms based on span programs. In 
this paper, we have only composed bounded-size span programs evaluating functions each on 0(1) bits. 
An intriguing question is, do there exist interesting quantum algorithms based directly on asymptotically 
large span programs? Some candidate problems may be found in ^BGW991 IBGP96j , although note that the 
quantum algorithm works for span programs over C that need not be monotone. 
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A Proof of Theorem 3.7 



In this section we will prove [Theorem 3.7| Before beginning, though, let us show that the alternative 
expressions for the span program witness size wsize(P, a;) of Definition 3.6 are equivalent, so wsize(P) is well 
defined. It will also be useful to derive several alternative expressions for wsize(P, x). 

Definition A.l (Additional matrix notations). Recall Definition 3.4 Let (o| = Aqj = {t\A and let C = 
(1 - \t){t\)A, so A= C+\t){o\ (the m,atrix Acj is C with range restricted to 1- \t){t\). Let A = Cn(Cn)+ be 
the projection onto the range of CIl, and let A = I — A. For a matrix M and a projection &, let Mq denote 
the restriction &MQ of M to the range ofQ. For a vector rhj, we will commonly write rh = X^jej "^ilj)O I 
for the diagonal matrix with diagonal entries rhj. \Figure ^ summarizes the matrices used in this section. 

We will use several times the following estimates for pseudoinverse norms: 

Claim A.2. For matrices A and B with Range(S^) C Rangc(yl) (i.e., B = BAA+), \\A{BA) + \\ < \\B+\\ 



and \\{BA)+\ 

Proof Since A{BA)+ = A{BA)+BB^ 
\\A{BA) + \\ < \\B+\\. Then also \\iBA)- 



\A+A{BA) + \\ < ||yl+l,„ 
Lemma A. 3. For S any positive-definite, diagonal matrix, let 

mini„,\.4ni,„\=irt 



[A{BA)'^{BA)A'^'^B^ and the bracketed term is a projection. 



Then if fp{x) = 1, 



wsize5(P, x) 



wsize5(P, x) 



^\w):ATl\w) = \t) 

^^^\w'):(t\w') = l 11^^^ |w' 
UA''\w')=0 



iffp{x)^l 
iffp{x) = 



\{o\US-'\w) 



0)11 



and, if fp{x) = 0, 



wsize5(P, x) 



mm 

|ji'):(lo|n|jii)=l 
CIlS-^\w)=0 

\\{A\iS-')+\t)f 

||(n - {ciiS-^)+ciiS-^)s-^ 

min \{t\w')\~'^ 

|ji)'):||S/lt|u)')|| = l 
YlA'^\w')=0 

+ {TL{AS)+ AS - l)+\l){AS)+\t)\\-^ 
11(1 - (ACS)+ACS)S{1 - C\\lC^)+)\o)f 



□ 



(A.l) 



(A.2) 



(A.3) 
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Moreover, \'w*g) — argmin|„^.^jj|^^^|f^||S'|K;)|p = S "^{AIIS '^)'^\t) has norm \\\w*g)\\ = 0(1) and 
nA'\w')=o 

has norm \\\wg)\\^ 0{l). 

In particular, the two different expressions for wsize(P, a;) — wsize ^{P,x) in Definition 3.6 are equiva- 
lent, so wsize(P, x) and wsizc(P) are well defined. 

Proof. Assume fp{x) = 1. That min|^).^ns-i|™>=|t> 111^)11^ = ^'^^\w):{w\u\w)=i\{o\^S^'^\w)\'''^ is immediate. 

In general, argmin|^)^jv/|a;)=|6) II N> II therefore, min|„,),^ns-i|«.)=|t) llk>lP ll(^nS'~i) + |t)||2. By 

basic geometry, argmax|u,).||n|to)||=i|(o|nS'^^|w)| cx (l — {CUS^^)^ {CTiS^^))TlS^^\o) , i.e., is proportional 

cns~i|Mi>=o 

to the projection of n5^^|o) onto the space orthogonal to the range of S^^IiC^ . Eq. (A. 2) follows. 

Next assume fp{x) = 0. That min|^„'^.^(|^,'^^]^ ||5^^|w')|P = niin|^/^.jjg^t|y,'^j[^il(i|w')l^'^ is immediate. 

ua''\w')=o nA^\w')=o 
Now, without loss of generality, \t) G Range(j4) = Range(^S'), since otherwise fp is false on every input. 
Therefore, {t\w') = {t\{SA^) + {SA'^)\w') = {t\{SA'') + \w) if \w) = SA^\w'). We want to find the length-one 
vector \w) that is in the range of S'A^ and also of 11, and that maximizes |(t|(S'^^)"'"|u') p. The answer is 
clearly the normalized projection of {AS)^\t) onto the intersection Range(iS'A^) fl Range (11). In general, 
given two projections Hi and 112, the projection onto the intersection of their ranges can be written 1 — 
(nin2 — l)+(nin2 — l). Substituting Hi = 11 and 112 = {AS)^AS gives the second claimed expression. 

Finally, we show that min|„'^,^t|^'^^i \\SA^\w')\\^ = 11(1 - (AC S)+AC S) S {1 - C^UC^) + )\o)\\^ . Since 

nA+|tu')=o 

fp{x) is false, \t) does not lie in the span of the true grouped input vectors, \t) ^ Range(yin), or equivalently 
n|o) € Range(nC^). Therefore, there exists a vector \w') — \t) + \bc) that is orthogonal to the span of the 
true columns of A and has inner product one with \t). Any such \bc) has the form 

\bc) = -{IlC^)+m +A\v) , 

where \v) is an arbitrary vector with {t\v) = 0. We want to choose \v) to minimize the squared length of 

TiSA^\w') = STi{\o) + C^\bc)) 

^ 3(1 - C\llC^) + )\o) + SC^A\v) . (A.4) 

The answer is clearly the squared length of S{1 — C^(nC^)+)|o) projected orthogonal to the range of SC^A, 
as claimed. This corresponds to setting \v) = -{S C^A)+S{1 - C^UC^)+)\o). 

The norms of \wg) and \w'g) are bounded using Claim AT2| □ 

Remark A.4. The expressions for witness size in Eqs. (A. 2) and (A.3)\ look quite different depending on 
whether fp{x) = 1 or fp{x) — 0, with the latter case being more complicated. It can be seen, though, that 
|wsize(P, x) — wsize(P^, x)| = 0(1) for any fixed span program P, where P^ is the dual span program described 
in Section 2.3\ with fpt{x) = -^fp{x). 



Let us now show that if Zj < zj for all j E J, then wsize ^{P, x) < wsize(P, x) (Lemma A.6 1. This will 
be useful in showing that wsize(P, x) is a rough upper bound on the exact expressions that we will derive in 
the sections below. 



Remark A. 5. From Definition 3.6, it is immediate that wsize(P, x) is monotone increasing in each input 
complexity Zi. 

Lemma A.6. Let S and T be any positive- definite diagonal matrices. Then 

wsizegyj:^(P,x) < wsizes(P,a::) • (1 + ||T||) , (A. 5) 

wsizeyg2+j^(P,x) <wsizes(P,x) + 0(||T|p) . (A.6) 

In particular, if Zj is such that z'^ < Zj for all j G J, then wsize ^{P,x) < wsize ^-^{P,x) — wsize(P, x). 
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Aoj = {t\A 

Etrucj 

1 -n 



c 



{Ai/r-^ 



,\m 



2/2/+ = cn(cn)+ 

1 - A 

-A2(i + icfct) = r - A2(y + 1) 

X^- A,X(Xa)-ixA 
-A2ytAX-iAy_= -X^y^X/XAr'y 
ytA(%+l)-iAy 



span program matrix 
"constraint" part of the span program 
"output" row of the span program 
projection onto true grouped inputs 
projection onto false grouped inputs 

grouped input squared supports at A = 



input ratios 



grouped input ratios 
grouped input ratio multipliers 
grouped input complexities, j-, ^ -'j 

true constraints scaled down by \/S 

false constraints scaled up by \/l 

projection onto the range of true constraints 

complementary projection 

matrix to be inverted 

Schur complement of X/^ in X 

a part of the inverse of X 

a useful 0(1) matrix, V-V = 0{\^\\S\\^) 



Figure 6: Matrices used in the proof of [Theorem 3.7[ 



Proof. Eq. (A. 5) is immediate from the definition in Eq. (A.l) To derive Eq. (A.6)[ first note that 
+ T^\v)\\'^ = \\S\v)f + \\T\v)f. Then when fp{x) = 1, 

min m^)r + \\T\w)f)<\\S\w*s)f+\\T\w*s)r 

\w):AIl\w)=\t) 

= wsims{P,x) + 0{\\T\\^) , 

where we have used that \'w*g) = argmin|^^.^jj|^^^|(^ ||S'|z/;)|p has norm IHuiJ)!! = 0(1) by 
argument when fp{x) = is similar: 



Lemma A. 3 



The 



mm 

\w'):{t\w') = l 
YlA''\w')=0 



{\\SA^\w')\\^ + \\TA^\w')f) < wsizes(P,x) + \\TA^\ws 



where \w'g) = argminj^/^.^ji^/^^^ll'S'^^l^')!!^ 0(1) norm by 
nA^\w')=o 



Lemma A. 3 



□ 



A.l Quantitative eigenvalue-zero spectral analysis of Acp 

[Theorem 2.5| can be strengthened to put quantitative lower bounds on cto, the achievable squared magnitude, 
in a unit-normalized eigenvalue-zero eigenvector, on the output node either qq if fp{x) = I or bo if fp{x) = 0: 

Theorem A. 7. For an input x G {0,1}", define a weighted graph Gp{x) by deleting from Gp the edges 
{aj,bi) if the ith literal in Xj is true. Also let 



W = 1 



EE 



l]i\bm + W,){aj\) 



(A.7) 



Consider all the eigenvalue-zero eigenvector equations of the weighted adjacency matrix ^Gp(k); except for 
the constraint at ao, i.e., Eqs. (2.1) except (2. Id). By Theorem 2.5 these equations have a solution with 
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(ao|?A) =/= if and only if fp{x) = 1, and have a solution with {bo\ip) ^ if and only if fp{x) = 0. In 
fact, the solution \^) can he chosen so that the normalized square overlap 



Co 



_ \{{ao\ + {bo 



> 



wsize(P, a;) + constant ' 



(A., 



where the constant may depend on P but is independent of the aj, and wsize(P, x) is as defined in Defini- 



tion 3.6: with \/(Ti < Zi for all i. 



Remark A. 8. Note that \Theorem A7?\ implies the A = portion of \ Theorem ~3l\ The weights in W 
that, e.g., setting bi = 1 adds {bi\W\bi) = I/ctj to the squared normalization factor. 



Proof of \Theorem A. 7 Recall Figure 2 The vertex aj is a shared output node of all the inputs i £ Ij. As 
in the proof of Theorem 2.5 Eq. (2.1c) implies that aj can be nonzero only if grouped input j is true, i.e., 
if all i € Ij evaluate to true. 
For j & J, define ct,- by 



(i + E 



ieij 



-1 



E 



false i ^ Ij 



if j is true 
if j is false 



(A.9) 



From 



Definition 3.1 I/ctj < Zj. Roughly speaking, for each j, the vertices bi for i e Ij can be treated as just 



a single input vertex with associated weight <7j in W. Precisel y, if j is true, then (aj|Vl^|aj) = l/(Tj. 
And if j is false, then the bj- coefficients appear in Eq. (2.1e) only in the quantity {j\Aij{xy\bi.) = 
Efaiso i e Ij bi- In order to minimize the weighted squared norm (6/^. jW^lfo/^) = J2ieij \bi\'^ l^i for any fixed 
value of {j\Aij{x)^\bi.) , each hi for i false should be set proportional to cji (by Cauchy-Schwarz) , so 



min {bi.\W\hi. 

\bi^:{j\Aij(xy\biA = l' ' ' 



1 

(To 



(A.IO) 



Let 5- = J2j^j\j){j\- 

Case fp{x) — 1: When fp{x) = 1, set aj 
to maximize the magnitude of —ao ^ 



{aj\W\aj 
\w) 



1 (Eqs. (2.1b) 



: for all false grouped inputs j. Set the other aj so as 
Aoj\o.j) — (o|n|a,/), such that C\aj) = CIl\aj) — and 
at A = 0). Now, changing variables to 



and 



(2.1a) 



Ian I — max KoIIIct 

\w):{w\U\w)=\ 

cnsi/^|«;)=o 
= l/wsize^-i/2(P, x) 
> l/wsize(P, x) , 



(A.ll) 



using Eq. (A. 2) l/(Tj < Zj and the monotonicity of wsize(P, x) (Remark A.5). Finally, dividing by 
(1 + |aoP) so that the total norm is one, gives 



\ao\ 



> 



\ao\ 



wsize(P, a;) + 1 



(A.12) 



Ceise fp{x) = 0: When fp{x) — 0, for each true grouped input j set 6^ = for i G Ij. For each false 
j, set hi — for true i G Ij and set hi = /jfi/Efaisc i' e ij ^i'- Choose |/) to maximize \ho\'^ such 
that = 1 and, by Eq. |(2.1e)|at A = 0, \o)bo + C^bc) +n|/) = 0. Equivalently, writing 
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\w 



'\ - (bo- 
\bc . 



SO bo — {tlw'), we are constrained that n|/) = —A^w'), i.e. 



\bo\'= max \{t\w')f 

\w'):\\a-^^^A^\w')\\=l 

= l/wsize^-i/2(P, a;) 
> l/wsize(P, x) 



by Eq. (A. 3) and the monotonicity of wsize(P, x). The constructed state has weighted squared norm 

{-iplWlip) = 1 + |||w/*>|P, where = argniaX|^,^^||--i/2^t|^')||^il(t|u;')P- Normahzing, 

nA^\w')=o 



1 + 



< wsize(P, x) 



>lr 



It remains to show that |||u;'*)/6o|| — 0(1). Indeed, (^^^„^ |w'*) = argmin|^'^.^j|„'^^i||(T^"^/^yl^|w')| 
|w-*-i/2) has 0(1) norm by 



Lemma A. 3 



nAt|u)')=o 

□ 



A. 2 Small-eigenvalue spectral analysis of Acp 

Theorem A. 9. For a span program P and input x, given s/ with < Si < Zi for all i ^ I , let s = 

and r — = ^X^s^^ + Alls. Assume that < A < e/si for a small enough constant e > to be 

determined and for all i ^ I. Then the equations 

bj ^ r^^Ajjaj (A. 15a) 

XbQ = flo + Aojoj (A. 15b) 

Afoc = Acjaj (A.15c) 

Xaj = Aoj^bo + Acj^bc + Aij{x)''bi (A.15d) 

have a solution with ao,bo 7^ 0. Moreover, if ro = ao/bo and sq is defined as —l/(Xro) or ro/^ if fp{x) 
is true or false, respectively, then 

< so < wsizeyj(P, x) , (A. 16) 



where the grouped input complexities zj are defined in terms of zj in \Definition 3.S\ 

Proof. Similarly to the argument in Appendix A.l| it will be useful to define a "grouped input ratio" rj so 
that, roughly speaking, the vertices bi for i G /_,- can be treated as just a single input vertex. 

Definition A. 10 (Grouped input ratios). For j G J, let fj — {—^ + J2iei- '^^'^ ^ ~ 'l2j = 

{Aij^r^^Aij — A)^^. Like an input ratio ri, fj is large and negative if j is true, and small and positive 
if j is false. Therefore let Sj = — l/(Afj) if j is true, and Sj = fj/X if j is false. Let s — X]j^ilj)OI = 

-inf^i + \m, so f = -^ns"^ + Alls. 

Before proceeding, we need to establish that f and s are well defined. 

Lemma A. 11. Assume that < A < e/ Zi for a small enough constant e > and for all i € L. Then 
f = {Aij^r^^Ajj — X)~^ exists, so s exists as well. Moreover, for each grouped input j G J, Sj < Zj. 
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Proof. By definition, 

If all inputs in Ij are true, then 



so 1 < < 1 + J2iei, ^» ^ 1 



- A - A ' ^ 

true i ^ Ij 



false 2 £ /j 



-l/(Ar~,) = 1 + 



ieij 



Now assume at least one input in Ij is false. The true terms can be upper-bounded by A^ 



true i G I 



Si < 



AEis/j — l^j l^- other hand, if i is false then (Xsi) ^ > (Xzi) ^ > 1/e. Therefore, Sj > 0, and we 

also get Sj < + e'Amaxfaisc % e i ^i) for ^ constant e'. 



□ 



Now we will solve for the output ratio ro using Eqs. (A. 15 >d). Letting sq ~ t'o/A in case fp{x) — 0, or 
= — l/(Aro) in case fp{x) = 1, we aim to show that < sq ^ wsize ^{P,x). This will prove 

{P,x) S. wsize 



So 

since, by 



Theorem 



Lemma A. 6 



3.7| in [Section 3 We start by deriving an exact expression for tq- 



Theorem A. 9 
wsize(P, x). Our proof will follow the sketch below 



Lemma A. 12. The solution to Eq. (A. 15) has = if bo = 0, and otherwise, 

ro = A + (o| (^f - jrC^l + ^CfC^y^CP^ \o) , 
provided that f and (1 + jCfC^)^^ exist. 



(A. 17) 



Proof. Recall from 



Definition A.l 



Eqs. (A. 15a) and |(A.15c) into |(A.15d) and rearranging terms gives 



that |o) = Aqj^ and Acj is C with range restricted. Substituting 



A - Aij^r-'Aij 



\c^C^ \aj) = \o)bo 



From Eq. |(A.15b) if bo 7^ 0, then ao/bo = A — {o\aj)/bo, so 

ro = X+{o\{r-' + \c^C)-'\o) 

= X+{o\(^f- + {CPC^y^Cr^ \o) , 

by the Woodbury matrix identity |GV96] . provided that f and (1 + jCrC^)"-^ exist. 



(A.18) 



□ 



Remark A. 13 (Form of Eq. (A. 17) I. Note from Eq. (A. 17) that ro is a real number provided that all the 



input ratios rj are themselves reals. Also, note that ro depends on C only through C^C (see too Eq. (A.18) 



in the proof); in particular, left-multiplying C by U where U is any lin ear isometry (i. e., satisfying WU — \) 
has no effect. Since the grouped input vectors vj can be arbitrary in Definition 2.1 C^C is in general an 
arbitrary \ J\ x | J| positive semidefinite matrix. 



Now the main step in simplifying Eq. (A. 17) is dividing the matrix we want to invert into a 2 x 2 block 
matrix and applying the following well-known claim: 

Claim A. 14. Let X be an operator, and let A and A = 1 — A be a projection and its complement. Assume 
that is invertible. Let the "Schur complement" of X be (X/X^) = X^ — AAr(A'A)^^^A. // the Schur 
complement of X is invertible on A, then X is invertible, and X~^ is given by: 



AX-^A = (Xa)'^ + {XAr^X{X/XA) ^XiXAY 



AX-'A 



^{x/XAr^x{XAy 



AX-^A = -{XAy^X{X/XAy 
AX-^A^{X/XAy'^ 



(A.19) 
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Proof. Multiply out the matrices. □ 

Lemma A. 15. The inverse (l + ^CfC^)~^ exists, provided < A < e/z^ for a small enough positive constant 
e and for all i Cz I . 

Proof. Let y — Cs^^^^H, y — Cs^^^H, Y = yy'^ and Y = yy^ . We aim to show that exists, where 

X ^~\^{l+\crC^) , 
^ _A (A.20) 

= Y -X^{Y + 1) . 

Let A — yy^ be the projection onto the range of y, and let A = 1 — A. Then 

Xa^Y ~ \^A{Y + 1)A AXA^ -X^AYA 

AX A = -A^AFA X^ = ~X'^A{Y + 1)A (A.21) 

Now since Y is invertible on A (i.e., A = YY^), so is X. By the Neumann series, 

(^A)~' = r+(1 + 0(A2||S||2)) , (A.22) 



where we have used that ||F|| — 0(p||) and \\Y^\\ ~ 0(p||) (Claim A.2|, and where we write 0(A^||s|p) to 
mean some matrix with norm so-bounded. In particular, {Xa)~^ is positive definite on A. 
Let (X/Xa) be the Schur complement of Xa in X, 

(X/Xa) = - AX(Xa)"'XA 

= -X^A{Y + 1) A - X'^AY{XAy^YA . (A.23) 

As —{X/Xa) on A is the sum of the positive definite matrix A^A and positive semidefinite matrices, (X/Xa) 
is negative definite on A and in particular is invertible on A. 

„, . ■ - ■ as 



Since Xa and (X/Xa) are each invertible, on A and on A, respectively, X exists by Claim A. 14 



claimed. □ 
The following discussion will use the n otation from the proof of |Lemma A.15| It will also be convenient 



to let S = ^/S. We have from Eq. (A. 17) 



ro = X+ (o\r\o) + A(o|f C^A^^Cf |o) (A.24) 

= X-\{o\S-^Il\o)+X{o\S^U\o)+( \{o\S-^y'X-^yS-^\o) +X^{o\Sy^ X-^yS\o) \ 
^ V -X{{o\S-^y^X-^yS\o) +{o\Sy^ X-^yS-^\o)) J 

Our goal now is to expand the above expression as a series in A, evaluating the coefficients of 1/A and of A, 
and bounding higher-order terms. In order to expand X~^ as a series, we use the block decomposition of X 
and lClaim A. 141 

Let us start by evaluating two expressions, (Aa)^^ and V = —X^y'^ {X/ Xa) ^y, that will reappear 
frequently in the following analysis. 

Claim A. 16. (Aa)^^ satisfies 

(Aa)"' = y+ + A2r+(y + i)Y+ + r+o(A*||s||3)y+ (A.25) 

= Y+{l + 0{XTsf)) = 0{\\S\\) . 

Proof We know that ||(Aa)"^|| 0(||s||). Note that for matrices A and B, (A + B)-^ = {I - (A + 
B)-^B)A-^ = A~i(l - B{A + B)~i) = A-^ - A-^BA-^ + A-^B{A + B)-^BA-^ provided A&nd A + B 
are invertible. Applying this with A = Y and B — — A^A(F -|- 1)A gives 

(Aa)"^ = Y+ + X^Y+{Y + 1)Y+ + X'^Y+{Y + 1){Xa)^\Y + 1)Y+ 

= Y+ + X^Y+{Y + 1)Y+ + Y+0{X'^\\Sf)Y+ . □ 
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Claim A.17. Let V = -X^y^AX-'^Ay ^ -X^y^X/ XAV'^y- Then 

V = V + OiX'^\\Sf) where V ^ y'^AiY^ + ly^Ay 
In particular, \\V\\ < 1 and \\V\\ < 1 + OiX^\\sf) = 0(1). 
Proof. We compute 

V = -X^yHX^ - AXiXA)-'XA)-'y 

= y^ [A(r + 1) A + X^AY{XAr'YA\ y 
= [M(l + X^y\XAy^y)M^ + l] M , 



(A.26) 



(A.27) 



where M = Ay. Now X'^y'^ {X^T^y = 0{X'^\\~sf) since y = 0(||yi||). Therefore, M{l+X'^y\XA)-^y)M^ + 1 
is the sum of positive-definite and positive-semidefinite matrices, hence is invertible. Again use (A + _B)~^ = 
(1 - {A + B)-^B)A-^, now with A = MM^ + 1 = % + 1 and S = X^My'' {XA)-^yM\ to get 



V -V{X''yHXAr'y)V 
^V- \l + {X^yHXA)-'y)V 



(A.28) 



(A.26) 



then 

□ 



provided the inverse right- multiplying V exists. Indeed, M'^{MM^ + 1) < 1 for an arbitrary matrix 
M and in particular for M — Ay (if the singular- value decomposition of M is M = X^,; 

M^MM^ + l)-^M = Y.i ;;^?^N'>(«'I)- Therefore the inverse does exist, and we obtain Eq, 
Now, using Claim A.16| and [Claim A.17| we find 

AX-^A = {Xa)-^ + {Xa)-^X{X/XaVX{Xa)-^ 

^{XA)-^-x\XA)-^yVyHxA)-^ 



and 



= Y+ + X^Y+{Y + + Y+0{X'^\\~sf)Y+ 

^ X^Y+{1 + 0{XXsf))y{V + 0{XX4^))y\l + 0{XXsf))Y+ 
= Y+ + X^Y+ (~yVy^ + Y+1 + 0{X^\\~sf)^ Y+ , 

AX-^Ay = X^{XA)-^Y{X/XAy^y 



(A.29) 



= -{XAr^yV 

= -Y+{\ + 0{XXsf))y{V+0{X4sf)) 
= -Y+yV + Y+ -OiX^Sf'^) . 

In particular, \\AX~^A\\ = 0{\\~s\\) and \\AX-^Ay\\ = 0(||Sf Z^). 



(A.30) 



Let us now substitute the expressions we have derived into Eq. (A. 24) for rp. Consider each of the terms 
involving X^^ separately. First of all. 



^{o\S-'y^X-^yS-'\o) = \{o\S-'y\AX-^ A)yS-'\ 
= j{o\US-^y+yS-'ll\o) 



(A.31) 



+ X{o\IiS-^y+{l + Y~ yVy^){yYS-^li\o) 

+o{x'\\m , 
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where we h ave substitut ed Eg. |(A 29)|and apphe d \\S-'^y'iY+\\ = \\S-'^y+\\ = (9(1) ( |ClanTL A.2 |. 
Also, by |Claim A.17| and Eqs. |(A.29)| |(A.30)[ 



X^o\Sy^X-'yS\o) = X^olSy^A + AJX'^A + A)yS\o) 
= -\{o\SVS\o) + 0{X^\\Sf) 
= -\{o\TlSVSTi\o) + 0{X^\\Sf) . 

Lastly, by Eqs. |(A.29)| |(A.30)| 

XiolS-^y^fX-^ySlo) = X{o\S-^y'' AX'^iA + A)yS\o) 

= X{o\S-'y^Y+{l + 0{X^Sr))yS\o) 
-X{o\S~^y^Y+ [yy + 0(A2||S||5/2)l S\o) 

= X{o\nS-'y+{y - yV)STi\o) + 0{X^:sf) 
Substituting Eqs. |(A.31)| |(A.32)[ [(X33)] into the expression for ro gives 

ro = -Uil - y+y)S-'U\o)r + X{v\{l - V)\v) + 0(A + A^||S||3) , 



(A.32) 



(A.33) 



(A.34) 



where \v) — {SH — y^ (y^)'^ S ^)|o). From the singular-value decomposition, one infers that {1 — M^MM^ + 
l)-iM) - (1 - M+M) = M+(l - (MAff + l)-i)(Mt)+ for any matrix A/, and in particular for M = Ay. 



Moreover, (w|(Ay)^(l - (1% + l)-i)((Ay)' = 0(1), since \\S{Ayy\\ = 0(1) and = 0(1). 

Therefore the above equation simplifies to 



ro 



y+y)S-'U\o)r + A(||(l - {Ayf {Ay))\v)r + 0(1)) + 0(A^p|p) 



(A.35) 



This is as far as we can simplify ro in general. When fp{x) — 1, the first term is — 1/(A wsizes(-P, x)), 
as desired, using the last expression of Eq. |(A.2) fo r wsize s(P, x). Assume then that fp{x) = 0, i.e., 
n|o) e Range (not). In this case, the first term in Eq. |(A.35)| is zero, and the second term can be simplified 
slightly further. Using (yt)+S'-i|o) = {nS-^C^)+ S-'^\l\o) = {nC^) + \o) and nC\nC^)+\o) = n|o), 

\v)^{Sli-y\llC^) + )\o) 

= (5n-yt(not) + )|o) + 5n(l-Ot(nOt) + )|o) (A.36) 
^ S{l-C\\lC^)+)\o) . 

Moreover, since AOS'H = 0, Ay = AOSB = AOS'. Therefore, ||(1 - (Ay)^ (Ay))\v)f = wsizes(P,x) , as 
desired, using the last expression of Eq. (A. 3) for wsize5(P, a:). This concludes the proof of Theorem A. 9 □ 

[Theorem A. 9| completes the A 7^ portion of [Theorem 3.7| finishing its proof. □ 



B Quantum algorithm 

The approach outlined in [Section 4.4[ is slightly indirect. To motivate it, we begin by briefly considering 



Section B.l a more direct algorithm ACQ' , that runs phase estimation directly on exp(iv4g,^j.^-j). ACQ' 
is analogous to the algorithm described by Cleve et al. jCCJY07j soon after the original NAND formula 
evaluation paper |FGG07j . Algorithm ACQ' is nearly optimal, but not quite. The operator exp(iA(j^^^-j) is 
a continuous-time quantum walk, and the overhead can be thought of as coming from simulating continuous- 
time quantum dynamics with a discrete computational model, in particular with discrete oracle queries. To 



avoid this overhead, the proof of Theorem 4.7[ in [Section B.2[ works with a discrete-time quantum walk. 



The approach in [Section B.l is optional motivation, and the reader may choose to skip directly to 
[Section B.2l 
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B.l Intuition: Continuous-time quantum walk algorithm 



Theorem 4.16 immediately suggests the basic form of a quantum algorithm for evaluating ip{x) 



Algorithm ACQ'- Input x g {0, 1}^, Output true/false 

1. Prepare an initial state on the output node, |ao). 

2. Run phase estimation, with precision 5p < 



error rate S^, on the unitary V — exp(z74g,^^^^/|j Ag,^j-pjv-) |C 



and small enough constant 



3. Output true if and only if the phase estimation output is A = 0. 



The idea of the second step is to "measure the Hamiltonian A^j^^^^y" In this step, we have normalized Aq 



by 



(0")l 



Gpix)\ 



instead of by \\A^ 



Gpix)\ 



in order to minimize dependence on the input x. This 



norm is 0(1) since the graph Gp(O^) has vertex degrees and edge weights all 0(1). 

Algorithm ACQ' evaluates ip{x) correctly, with a constant gap between its completeness and soundness: 



Theorem 4.16 implies that if the formula evaluates to true, then ^(5^(3.-) has an eigenvalue-zero eigen- 
state with squared support |aoP = ^(1) on ao- Therefore, the phase estimation outcome is A = 
with probability at least |aoP — Se = f^(l) (the completeness parameter). 



• On the other hand, if the formula evaluates to false, then Theorem 4.16 implies that Aq^^^^/\\A(^ 

has no eigenvalue- A eigenstates supported on ao with |A| < dp. Therefore, the measured outcome will 
be A = only if there is an error in the phase estimation. By choosing Se a small enough constant, the 
soundness error will be bounded away from the completeness parameter. 

The efficiency of ACQ' also seems promising. Phase estimation of V with precision Sp and error rate Sg 
requires 0{l/{6p5e)) calls to V [C EMM98j . Therefore, the second step requires only 0{Adv{ip)) calls to V. 
However, we still need to explain how to implement V. This is important because ^q^^^-) depends on the 
input X. Therefore, implementing V requires querying the x. If each call to V requires many queries to the 



(4.3) then the overall query efficiency of ACQ' will be poor. 



input oracle Ox of Eq. 

Note now that only the input edges of Gp{x) depend on the input x. Therefore, Aq^^^^^ can be split up 
into two terms: (input edges) -I- (all other edges). The first term can be exponentiated with only two queries 
to the input oracle O^, while exponentiating the second term requires no input queries. The two terms do 
not commute, but the exponential of their sum can still be computed to sufficient precision by using a Lie 
product decomposition. These are more quantitative versions of identities like e"^^^ = lim„_>oo(e"^/"e^/")". 
For more details, see [ CCJY07] . 

Unfortunately, implementing the exponential of ^q^j^j will require lo^I) input queries. By using higher- 
order Lie product formulas, the overhead can be reduced to exp(0(A/k)g|x|)), which is N°'^^\ However, 
this is still a super-constant overhead, so it appears that this approach cannot yield an optimal formula 
evaluation algorithm — the best we can hope for is 0{Adv{ip)) ■ N"^^") queries. 



B.2 Proof of Theorem 4.7 Discrete-time quantum walk algorithm 



Therefore, we turn to the approach used in the NAND formula evaluation algorithm of [CRSZ07) . Instead of 
running phase estimation on the exponential of Aq^^^^ we construct a discrete-time, or "coined," quantum 

walk Ux — OxUqn, where Ox is the adjusted oracle of Eq. (4.9) that has spectrum and eigenvectors 
corresponding in a precise way to those of A^^^^y Then we run phase estimation on Ux- Each call to Ux 
requires exactly one oracle query, so there is no query overhead. 
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B.2.1 Construction of the coined quantum walk Ux 

The first step in constructing Ux is to decompose Aqp(^qn^ into (constant) • A^oA, where A is a square matrix 
with row norms one, and o denotes the entrywise matrix product. We follow [CRSZOT] . One minor technical 
difference, though, is that for us, A^^f^^^ is a Hermitian matrix with possibly complex entries. In [ CRSZ07, . 
the analogous weighted adjacency matrix, for the NAND formula ip, is a real symmetric matrix. Therefore, 
we need to slightly modify the construction of A to obtain the correct phases for the entries of ^Gj=(o")- 

Definition B.l. For notational convenience, let A — Aq^i^qn -^ be the weighted adjacency matrix for Gp{0^). 
(Recall from Theorem J^.16 that Gp{0^) is the same as Gp except with the edge weight on the output edge 
{ao,bo) reduced.) A = ^ Ay^w\v){'w\ is a Hermitian matrix. 

Gp{0^) is a bipartite graph, so we may color each vertex red or black, such that every edge is between 
one red vertex and one black vertex. 

Claim B.2. Let A' = '^^^ ^\Ay .^\\v){w\ be the entrywise absolute value of A. A' is a real symmetric 
matrix. Let \\A'\\ be the largest-magnitude eigenvalue of A' . Let \6) be the principle eigenvector of A' , with 
{v\5) — 5y > Q for every v, and let 



1 



black V 
red w 




\v){w\ + 




w){v\ 



(B.l) 



Then A has all row norms one, and A 



\A'\\ • Ato A. 



Proof. Since A' has nonnegative entries, the principal eigenvector \6) is also nonnegative. Since Gp{0^) is 
a connected graph, 6y > for every v. Hence A is well defined up to choice of sign of the square root, which 
doesn't matter. 

By construction, for all v and w, A* ^A^^^ — Ay,iu/\\A'\\, i.e., ||y4'|| ■ o A = A. Furthermore, the 
squared norm of the v-th row of A is J2w\^v,w\'^ " 



_J L v 4' A — 

IIA'II (5„ A^w ^v,w"w — 



i5„ 



□ 



Remark B.3. Ln defining A, we have evenly divided the complex phases of entries of A between red-black 
and black-red tern, 

also hold with Eq. 



and black-red ter ms. How ever, any division of the phases would have worked. For example, \Claim B.2\ would 

\ V [ ~ 

w \ 



(B.l) 



replaced by A = 



At . 



1^ 



to that of a 



We can now apply Szegedy's correspondence theorem |Sze04j to relate the spectrum of Acf 
discrete-time coined quantum walk unitary. 

Theorem B.4 f |Sze04| '). Let {\v) : v G V} be an orthonormal basis for Hv- For each v E V, let \v) = 



G Hv <Xi Hv, whe 



EJSv^l' = 1- Let T = I^^X^'I n = rrt = 



be the projection onto the span of the \v)s. Let S = J2v w 1^7 ''^l; ^ swap. Let U — (211— 1)S, a swap 
followed by reflection about the span of the \v)s. Let M — ST ~ ^ Svw^wv\v){w\. 

Then the spectral decomposition of U corresponds to that of M as follows: Take {|Aq)} a complete 
set of orthonormal eigenvectors of the Hermitian matrix M with respective eigenvalues Aq. Let Ra = 
Span{r|AQ.), ST\Xa)}. Then Ra -L Ra' for a ^ a' ; let R = (BaRa- U fixes the spaces Ra and is —S on R^ . 
The eigenvalues and eigenvectors ofU within Ra are given by Pa.± — Aq ± i-^/l — A^ and {1 + l3a_±S)T\Xa) , 
respectively. 



Theorem B.4 



in the above form is given in [CRSZOT] > and see |MNRS07] 



1)5* in \Theorem B.J^ is known as a "coined 

operator. " 



A proof of 

Remark B.5 (Coined quantum walks). The operator U = (211- 

quantum walk. " S is known as the "step operator, " and the reflection (211 — 1) is the "coin 
On the space R, (211 — 1) decomposes as \v){v\ ® {reflection about 5i,w\w)). 

In a classical random walk on a graph, a coin is flipped between each step to decide which adjacent vertex 
to step to next. In a coined quantum walk, on the other hand, the coin is maintained as part of the coherent 
quantum state, and is reflected between steps (also known as "diffusion"). 
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Remark B.6. Theorem B.4 can be viewed as giving a correspondence between coined quantum walks and 
classical random walks; in the special case that each dvw — S^v > 0, M is a classical random walk transition 
matrix. For general 6yw, \ Theorem B.4\ can be viewed a correspondence between coined quantum walks and 
continuous-time quantum walks. We use the theorem in the latter sense. 



Lemma B.7. For A defined by Eq. (B.l) and with 5,^^ — ^v,w, let Uqn be the coined quantum walk operator 
Uqn = ill — i(2n — 1)S in the notation of Theorem B.^ Uqn acts on TLy ® T^v , where V is the vertex set 
of Gp. For X € {0, 1}''^, let Ux = OxUqn , where Ox applies a phase (—1)^* to input vertex hi and otherwise 



does nothing (see Eq. (4-. 9)). Then, 



• If ip{x) = I, there exist eigenvalue 1 and eigenvalue —1 normalized eigenstates of Ux each with 
support on \ao,bo). 

• If (p{x) = 0, then Ux does not have any eigenstates supported on lap, b p) with eigenv alues ±e'^ for 



|A| < arcsin( 



\\A'\\ Adv(^) 



) = ri(l/Adv((/?)), where e > is the constant of 



Theorem 4.16 



Proof. Note that for an input vertex hi on a span program input edge (a^, hi), the bith row of A is {bi\A — {ai\. 
Define A(a;) as follows: If Xi — 1, then let {bi\A{x) — {bi\ (i.e., in the classical walk formulation, make bi a 
probability sink), and let the other rows of A(a;) be the same as those of A = A(O^). 

In the notation of Theorem B.4 with each S^ui set to the {v,w) entry of A(a:), the vectors \v) do not 



depend on a; if u ^ {bi}ieij whereas 



\bi,ai) if = 
\bi,bi) if Xi = I 



Therefore, in M = A{xy o A(a;), entries (a^, bi) and {bi, ai) are zeroed out when Xi — 1, whil e other entries 
are unchanged: so M = O^^g ^x^■ ^.Iso, on R, iU = i(2n — 1)5' is the same as Ux. So 



Theorem B.4 



A'\\^^Gp{x) 

implies that the spectrum of Ux = OxUqn corresponds exactly to that of If the eigenvalues of 

A'W are {Aq,}, then the eigenvalues of Ux are given by iPa,± — ±-\/l — + i.e., ^^^^^^^'^'^ and 



^—i arcsin A 



In case '^(x) = 1. 



Theorem 4.16 



promises that J^Qp^x) eigenvalue-zero eigenstate with ri(l) support 



on ap. Denote this eigenstate by \\a = 0). By Theorem B.4 (1 ± iS)T\\a = 0) are eigenstates of Ux with 
eigenvalues ±1. Since T\ap) = \ap,bp), the eigenvectors (1 ± iS)T\\a ~ 0) each have ri(l) support on 
\0'O:i>o)- Moreover, this remains true even after renormalizing: T is an isometry, while the swap S is 
unitary, so 11(1 ± i^jrlAa = 0)11 < 2. 

The claim also follows for the case '■p(x) = by Theorems |4.16 and |B.4[ Every eigenstate of iU with 
support on \ap,bp) = T\ap) must be of the form (1 + /3a,±5)r| A^,) = (1 + (A„ ± Vl - Xl)S)T\Xa) . The 
terms which can overlap T\ap) are either {ap\Xa) (via T) or {bp\Xa) (via ST). But by Theorem 4.16[ both 
coefficients must be zero. Note that \\A'\\ = 0{1) since the graph G'p(O^) has vertex degrees and edge 
weights all 0(1). Therefore, the spectral gap from zero of ^(3^(2:) /II ^'11 is only a constant factor worse than 



that of A 



Gpix)- 



□ 



B.2.2 Algorithm ACQ, correctness, and query and time complexity 



Algorithm ACQ: Input x E {0, 1}", Output true/false. 

1. Prepare an initial state on the output edge \ap,bp). 

2. Run phase estimation on Ux = OxUqn , with precision Sp < arcsin(^^ Advjlpj] 
small enough constant error rate S^. 

3. Output true if the measured phase is or n. Otherwise output false. 



and 



Correctness: Lemma B.7 implies that ACQ is both complete and sound: 
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Figure 7: Function numbering scheme. We number each four-bit function by considering its sixteen-bit 
truth table as the binary representation of an integer. For example, f{xi, X2,x^, X4) = xi A X3 is numbered 
204 = 4 + 8 + 64-1- 128, while xi A X2 is numbered 15 = 1 + 2 + 4 + 8. These two functions are equivalent, 
so in the table below we only list number 15, the smaller of the two. 



• If ^p{x) — 1, then U{x) has eigenvalue- (±1) eigenstates each with 17(1) squared support on \ao,bo)- 
The completeness parameter is at least this squared support minus the phase estimation error rate Se- 
For small enough constant S^, the completeness is 17(1). 

• If ip{x) = 0, then since the precision parameter 6p is smaller than the promised gap away from ±1 
in |Lcmma B.7| phase estimation will output or tt only if there is an error. By choosing the error 
rate 6e a small enough constant, the soundness error 6e will be bounded away from the completeness 
parameter. 

Therefore, algorithm ACQ is correct. The constant gap between its completeness and soundness parameters 
can be amplified as usual. 

Query and time complexity: Phase estimation of with precision 6p and error rate Sg requires 
0{l/{SpSe)) calls to = O^UoN |CEMM98] . Therefore, ACQ makes 0(Adv((^)) queries to the input 
oracle O^- 

The time-efficiency claim of [Theorem 4.7| is slightly more complicated. Here, we need to allow a pre- 
processing phase in which the algorithm can compute ^g^^o") ^-"^^ particular (approximations to) the 
coin diffusion operators in Uqn. This preprocessing depending on ip, but not x, takes poly(iV) time. The 
algorithm then needs coherent access to th e precomp uted information in order to apply efficiently the coin 
diffusion operators. For further details, see |CRSZ07 . 

This completes the proof of [Theorem 4.7| □ 



C Table of functions on up to four bits 

Which four- bit gates can be added to the gate set S without affecting the correctness of [Theorem 4.8| or 
[Theorem 4.7[ ? As summarized in [Section 5.1[ we have made partial progress toward answering this question. 
In this appendix, we present a table that lists all the four-bit gates, up to equivalences, and says what we 
know for each gate. 

Definition C.l. Two k-bit boolean functions /i, /2 : {0, 1}*^ — > {0, 1} are equivalent if there exists a string 
y G {0, 1}*^ and a k-element permutation a G Sk such that either for all x e {0, 1}*^ fi{x) = f2{cr{x) y), or 
for all X e {0, 1}*^ fi{x) = ^/2(f(a;) ® y). Here for a bit string x = X1X2 . . . Xfe G {0, 1}''', (t{x) £ {0, 1}*^ is 
defined as x„-i(^ijx^-ii^2) ■ ■■Xa-^k)- 

That is, two functions are equivalent if they differ by permuting the inputs, and complementing a subset 
of the input bits and output bit. There are 222 inequivalent four-bit functions. We number each function for 



reference by considering its sixteen-bit truth table as the binary representation of an integer as in Figure 7 



The table begins with the fourteen inequivalent functions of Figure 5 that depend on at most three input 
bits. The 208 functions that depend on all four input bits are first sorted according to their polynomial 
degree |Amb06a] and then by their non-negative- weight and general adversary bounds, Adv and Adv*. If 
these two b ounds a re equal, then we state only the first of the two. The numerical adversary bounds were 
taken from IHLS06I. 
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For each function, we give its {AND, OR, NOT} formula size. Note that by Lemma 4.12[ a function 



of formula size k has a trivial span program with witness size V~k. The table includes comments on some 
of the functions. These comments might include, for example, the smallest-size {AND, OR, NOT} formula 
for an equivalent function. For some of the functions, e.g., |#7128| we have listed in the Status column the 
witness size for the best span program we have found that computes the function. Those functions for which 
we know an optimal span program, with witness size matching the adversary bound, are marked with a 



checkmark (/), together with a brief justification. For example, a reference to Lemma 4.12 means that the 
optimal span program follows from composing two simpler span programs based on an OR or PARITY gate. 
The lower bound for such functions follows from a simple fact on composition of adversary lower bounds: 

Lemma C.2. For two functions /i, /2 on disjoint inputs, Adv(/i /2) = Adv(/i) + Adv(/2), and Adv(/i V 
/2) - VAdv(A)2 + Adv(/2)2. 

For a function / marked "opt. NAND," the optimal span program comes from optimizing the edge weights 
of the tree corresponding to a minimal- size NAND formula computing /. 



Listed below the table are the optimal adversary matrices (Definition 4.3 1 and optimal span programs 



for all the four-bit functions for which we know an optimal span program, except when one bound or the 
other follows from other stated results, e.g., from [Lemma C.2| or [Lemma 4.12[ In a Mathematica file included 
as an electronic supplement to this article, we have included code to verify the adversary bound and span 
program witness size calculations. 

For details on any of the span programs referenced with witness size that does not match the adversary 
lower bound, e.g., for function 7^7128| please contact one of the authors. 



Functions depending on up to three input bits: 



# 


Size 


Adv 


Adv=" 




Status 






Comments 













/ trivial 






constant 


255 


1 


1 




/ trivial 






Xi 


15 


2 


V2 




/ 


Lemma 4.12 


Xi V X2 


3 


3 


V3 




/ 


Lemma 4.12 


xi V a;2 V X3 


63 


3 






/ 


Lemma 4.12 


xi V {x2 A X3) 


4080 


4 


2 




/ 


Lemma 4.12 


Xi X2 


975 


4 


2 




/ 


Lemma 4.12 


{xs A X2) V (x^Axi) 


831 


5 


2 




/ 


Claim 4.9 






MAJ3 


960 


6 


3/V2 




/ 


Claim 4.10 




EQUAL3 


963 


5 






/ 


Claim 4.11 




{xi AX2A X3) V A x^) 


60 


5 


V5 




/ 


Lemma 4.12 


Xi V {x2 ® 2:3) 


1020 


6 


1 + V2 




/ 


Lemma 4.12 


Xi ® {X2 A 2:3) 


828 


8 


V7 




/ 


Lemma 4.12 


EXACT2of3 


15555 


10 


3 




/ 


Lemma 4.12 


xi (B X2® X3 



Functions depending on four input bits, with polynomial degree either two or three: 



# 


Size 


Adv 


Adv=^ 


Status 


7128 


10 


2.50000 


2.51353 


2.77394 


863 


5 


2.00000 


2.07136 


2.22833 


427 


5 


2.18398 


2.20814 


2.22833 



Comments 

sorted input bits |Amb06a| . (xi A ((x-y A 
X3) V (x^Axj))) V (xIA ((x^Ax^) V (x3 AX4))) 
monotone two adjacent Is, {X1AX2) V (a;4 A 
{xi V X3)) 

#975 'a;i Ax2,X3,Xi) 
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# 


Size 


Adv 


Adv=^ 


27 


5 






393 


6 


4/V3 




OOO 


/ 


z.oUz / o 


O Q /I /t C\C\ 

Z.o44UD 




'-7 
t 


/l 1 /o 

^11/2 




24 


7 


v/11/2 




303 


6 


2.35829 




495 


6 


1 + V2 




989 


6 


l + %/2 


— 


965 


7 


2.41531 


2.42653 


987 


7 


2.43128 


2.44711 


424 


8 


V6 


— 


2034 


7 


2.47323 


2.48653 


429 


7 


2.48837 


2.50826 


490 


8 


2.52207 


2.52326 


281 


8 


2.51464 


2.54019 


2022 


8 


2.55719 


2.58189 


1968 


8 


2-y/5/3 




1 7fi0 
i /OZ 


7 




z.oyu4u 




Q 

O 






1973 


8 


2.61704 


2.63510 


1910 


8 




- 


317 


8 


V7 




858 


8 


2.64575 


2.64658 


300 


9 


2.69932 


2.70595 


6030 


10 


2.70928 


- 


894 


10 


2.70808 


2.71982 


1714 


10 


2.75018 


2.75944 


1980 


9 


2.75779 


2.77469 


1719 


9 


2.76916 


2.78319 


366 


10 


2.76569 


2.80341 


6042 


10 


2.84104 


2.84923 


1716 


10 


2.86854 


2.88186 


1680 


12 


3 


- 


1695 


10 


3 


- 


5790 


10 


3 


— 


( i4U 


1 n 
iU 


Q 
O 




1683 


11 


3.00283 


3.01009 


5766 


12 


3.02533 


3.03595 


6627 


12 


3.01470 


3.04933 


5783 


12 


3.03917 


3.07294 


6375 


14 


1 + V972 





Status 



Comments 



/ Lemma 4.12 



/ opt. NAND 
^4 + 73 



Lemma 4.12 



Lemma 4.12 

72 



1 



/ opt. NAND 
/ opt. gadget 
2.59234 



xi A #975'a;2,a;3,a;4) 

{xi A X2 A X3) V {xi Ax2 A X4) 

{xi A X2 A X3) V {{xi V a;2 V x^) A X4) 

xi A ^ TiiQ,\JAL^{x2jX3, X4) 

xi A EQUAL3(a;2, 2^3, X4) 

({xi V X2) A x^) V ((STl V X2) A X4), span 

program size 5 

#975'a;i,a;2,a;3 A x^) 



{xi A X2 A Xy,) V {xi A {X2 V Xi)) 

[xi A X2 A X3) V (2:4 A Xs) V {x4 A X2) 



/opt. NAND EQUAL3(a;i,a;2,a;3 Aa;4) 



/ opt. NAND 
2.61804 



{xi A X2 A (x3 V X4)) V [xi Ax2 A [xy, V xa)) 



#975 'xi ®X2,X'i,X4) 



/ opt. NAND [xi A a;2 A 0:3 A 2:4) V (xi A X2) V (2:3 A X4) 
Lemma 4.12 [xi A X2 A xz) ^ MAJ3(^, a;4) 

+ 2\/2 (xi A 2:2 A 2:3) V (S^ A X4) V (xl A (x^ V^)) 

3 (2;! A (2:2 V 2:3) A (x^ V 2:4)) y {xl A {x^y 

2^3) A (2:2 V 2^4)), classical three-query alg. 



/ opt. NAND 
/ opt. NAND 
/ opt. NAND 



Lemma 4.12 



EQUA L3(2:i, X2, 2:3 ® X4) 

#975 '2;!, 2:2, 2:3 © 2:4), tight classical alg. 

XxTa {x2 V 2:3) A (x^ V 2:4)) V (xT A (2:2 V 

X3) A (^2 V 2:3)), tight classical alg. 

xi (E #975 '2:2, 2:3, 2:4), tight classical alg. 



/ Lemma 4.12 



xi ® EQUAL3(2;2,2;3,a;4) 



Functions depending on four input bits, with polynomial degree four: 



1 



Size 
4 



Adv 
2 



Adv' 



Status 



Comments 



/ Lemma 4.12 2:1 A 2:2 A X3 A X4 
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# 


Size 


Adv 


Adv=^ 




Status 


127 


4 


2 


— 


/ 


Lemma 4.12 


61 


4 


1 






Lemma 4.12 


7 


4 


2 




/ 


Lemma 4.12 


oOO 


A 


9 

z 




/ 

V 


Lemma 4.12 


319 


6 


2 17533 


2.20453 




2.27731 







z.zuuoo 


9 90791 






23 


6 


^/5 

V ^ 




/ 


Lemma 4.12 


399 


6 


2.22595 


2.25274 






287 


6 


^3 + 75 


- 


/ 


Lemma 5.2 


384 


8 


4/V3 




/ 


Claim 4.10 


447 






z.ol/0/ 






385 


7 


(l/2)Vl3 + \/73 




/ opt. NAND 


ovo 


R 
U 


9 9Qnf^9 

Z . Zc/UUZ 








2032 


6 


(''7 1 /o 

^(7 + V17)/2 




/ opt. NAND 


426 


6 


A/f7 + a/T7)/2 




/ opt. NAND 




u 


z.ouuyo 


z.o / uu^ 






25 


6 


\/4 + V3 




/ 


Lemma 4.12 


61 


6 


V4+%/3 


— 


/ 


Tyemmfl 4 19 


981 


7 


2.39489 


2.40490 






283 


7 


2.40091 


2.42364 






no o 


D 


Z.4ZZDD 


Z.4z4z4 








7 


9 "^Ql 90 








961 


7 


2.43531 


2.43869 






111 


6 


V6 




/ 


Lemma 4.12 


1638 


6 


V6 


— 


/ 


Lemma 4.12 


279 


8 


/ — 

V6 


— 


/ 


Example 5.] 


6 


6 


\/6 


- 


/ 


Lemma 4.12 


387 


7 


2.48662 


2.50251 






859 


7 


2.49857 


2.50575 






988 


7 


2.53791 


2.53835 






411 


8 


2.52192 


2.54009 






1654 


7 


2.51758 


2.54347 






445 


9 


2.53019 


2.55017 






425 


7 


2.55654 


- 




2.55654 


494 


7 


2.55654 


- 




2.55654 


2018 


8 


2.54502 


2.55711 






2016 


8 


2.55128 


2.55874 






2033 


8 


2.56155 






2.59163 


4ty ± 


7 


Z.OOOOO 


9 "^7001 

z.o / yui 




2.64302 


879 


8 


2.57641 


2.58289 






415 


8 


2.57096 


2.58436 






4/0 


Q 
O 




Z.DUDio 






430 


7 


2.60716 


2.60975 






30 


7 


V/4 + 2V2 




/ 


Lemma 4.12 


2019 


8 


2.61439 


2.62037 






488 


10 


2.62705 








1639 


8 


V7 




/ opt. gadget 


1969 


9 


2.64898 


2.65285 







Comments 

x\ V (x2 A X3 A X4) 

xi A {x2 V (a;3 A x^)) 

xi A a;2 A [x^ V X4) 

[xi V 0:3) A {x2 V 0:4) 

[xi A (x2 V 2:3)) V {x2 Ax^ A Xi) 

{{xi V X2) A X'i) V {xi A X4) 

xi A MAJ3(a;2, 0:3, X4) 

MAJ3(a;i,a;2,a;3 A X4) 
EQUAL4 

(xi V {x2 A X3)) A (xT V (x^ A A X4)) 



#963 xi,X2,X3 VX4) 



#963 ^xi, X2, X3 A X4) 



Xl 

xi V 



#963 



#963 



X2-,X^,Xi) 
X2,Xz,Xi) 



Xl V[#60|X2,X3,X4) 

(xi A X2) V (x3 ® X4) 
Tlireshold2 of 4 

Xl A X2 A (X3 © X4) 



#963 



#963 



Xl A X2, X3, X4), exact exp. for Adv? 
Xl V X2, X3, X4), exact exp. for Adv? 



((xi V X2) A X3 A X4) V (x2 A X3) V (x3 A X4) 
(xi A X2 A X3) V (x4 A (xT V (x^ A xt))) 



Xl ^ #1020 >2, 2:3, a;4) 



(xi A X2) V MAJ3(xi A X2,X3, X4) 



34 



# 


Size 


Adv 


Adv=^ 




Status 


1778 


8 


2.66716 


2.66873 






985 


8 


2.65949 


2.67406 






980 


9 


2.67345 


2.67735 






1650 


8 


2.67869 


2.68369 






391 


9 


2.68828 


2.70027 






878 


9 


2.68845 


2.70057 






1918 


10 


2.70131 








386 


9 


2.67082 


2.70300 






966 


8 


2.70246 


2.70500 






367 


8 


2.70387 


2.70585 






1662 


9 


2.69544 


2.70815 






1 77R 
1 / / D 


Q 
O 


y (y + \i 66)1 1 




/ opt. NAND 




1 n 


71/111 


9 71 R'?Q 
Z. / iDoy 






408 


9 


2.69951 


2.71811 






301 


8 


2.71328 


2.71856 






1647 


8 


1 + vs 




y 

V 


Lemma 5.2 




2040 


8 


1 + V3 


— 


/ 


Lemma 4.12 


510 


8 


1 + V3 


- 


/ 


Lemma 4.12 


1634 


8 


2.74013 


2.74148 






856 


9 


2.73510 


2.74171 






892 


9 


2.72608 


2.74205 






316 


9 


2.74228 


2.74790 






862 


9 


2.74628 


2.75157 






829 


9 


2.75490 


2.76384 






990 


8 


2.76066 


2.76706 






1651 


8 


2.75952 


2.76736 






1715 


9 


2.76490 


2.77389 






489 


9 


2.78575 






2.86182 


6040 


10 


2.77499 


2.79246 






1914 


9 


2.79485 


- 




2.85539 


282 


9 


2.80369 


— 




2.92535 


1972 


9 


2.79678 


2.80499 






oyo 


Q 


9 7QRQ/1 


9 snRn7 

Z.oUDU / 






444 


10 


2.80787 


2.81297 






874 


10 


z. 8 1477 


z. 81815 






1 n? 

1 U 1 


Q 


9a/9 

Zi Y z 




/ 


Lemma 4.12 


1632 


8 


2^/2 




/ 


Lemma 4.12 


22 


9 


2^/2 




/ 


Lemma 4.12 


6014 


12 


2^/2 


— 


/ opt. gadget 


854 


8 


2\/2 




/ 


Lemma 4.12 


6060 


10 


2.82034 


2.83150 






875 


9 


2.83428 


2.83570 






2017 


10 


2.83417 


2.83655 






1712 


10 


2.84346 


2.84354 







Comments 



{xi A X2 /\ (^3 V 
-1 EQUAL4 {x2,X3,Xi)) 



Xi)) V {xi A 



#963 xi,X2,X3 ® X4) 



MAJ3 {xi,X2,X3 (B Xi) 

Xi (X2 A {x3 V 0:4)) 
2^1 © {X2 A ^3 A X4) 



{xi A a;2 A X3) V (2:4 A (x2 V X3) A {xi 
X3))), X2 and X3 symmetrical 



V(x^A 



(xi Ax2 A (0:3 VX4)) V (x3 Aa::4) V (oFl AZC3 Axf) , 
x^ and X4 symmetrical 
(x7 A xi" A xi) V (a;3 A 2:4) V ((xi V 2:2) A (x3 V 
X4)), X2 and X3 symmetrical 



Xi ^ #828'X2,X3,X4) 

(xi @ X2) A (xa ® X4) 

Xi /|#828j;X2,X3,X4) 



EXACT2 or 3 of 4 = 

Tlir.2 of 4(a;i,X2,X3,X4)A(xIVx^VxiVxi) 
(xi A X2) © (x3 A X4) 



35 



# 


Size 


Adv 


Adv=^ 


857 


9 


2.82909 


2.85105 


1718 


9 


2.84413 


2.85900 


382 


11 


2.87999 


- 


362 


11 


2.88004 


2.88205 


5758 


11 


2.89586 


- 


876 


10 


2.89815 


2.90403 


318 


10 


2.90163 


2.90404 


407 


11 


2.89638 


2.90417 


410 


10 


2.90592 


2.91505 


446 


10 


2.91254 


2.91560 


1974 


10 


2.91560 


2.91835 


363 


10 


2.92040 


2.92652 


1658 


10 


2.92940 


2.93141 


5774 


11 


2.92267 


2.93717 


1717 


10 


2.93360 


2.94668 


LI 1 1 




Z.ybi (D 








9 Qfi49^ 
Zi . y UttZhJ 


9 QfifiQfi 






9 QSfi/LI 


9 QSR?"? 

Zi. C/OU 1 o 




1 9 


o 






1 1 
1 1 


9 QQl^99 




1912 


10 






286 


10 


V5 + yi7 


- 


5786 


11 


3.01265 


3.02051 


1687 


11 


3.01018 


3.02207 


1681 


12 


3.02473 


3.02629 


360 


12 


3.04017 


3.04042 


1659 


11 


3.04139 


3.04288 


6625 


12 


3.02185 


3.04627 


5820 


11 


3.03542 


3.04710 


1725 


12 


3.04048 


3.05100 


877 


11 


3.04498 


3.05270 


390 


12 


3.03755 


3.05354 


872 


12 


3.06480 


3.06823 


5782 


11 


3.06111 


3.07244 


5784 


12 


3.07314 


3.07400 


5742 


12 


3.09004 


3.09058 


1686 


11 


3.11060 


- 


5804 


12 


3.11134 


3.11717 


2025 


12 


3.12714 


3.12849 


6038 


12 


3.12842 


3.12999 


414 


12 


3.12805 


3.13416 


5767 


13 


3.13610 


3.13705 


361 


11 


3.14864 




olol 


1 


0.i4( Di 


O. i04Z0 


105 


11 


a/To 




278 


12 


VTo 




1656 


12 


3.16284 


3.16420 


6630 


12 


1 + V3 + %/3 




1721 


12 


3.19509 


3.19570 



Status 



Comments 



Lemma 4.12 



xi ® MAJ3(a;2, x^, X4^) 



/ opt. NAND 
/ opt. NAND 



#828 



#828 



Xi V X2,X3,X4) 
Xi A X2,X3,X4) 



#963 'Xl © X2,X3,X4) 



Lemma 4.12 



Lemma 4.12 



Xi A {X2 ® X3® X4) 

EXACTiof4 = Thr. 3 of 4(^,^,^,54) A 
(xi V a;2 V 2:3 V X4) 



Lemma 4.12 



2^1 S #963'x2,X3,a;4) 
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# 



Size 



Adv 



Adv" 



Status 



Comments 



1913 
5763 
5771 
1643 
1633 
1785 
873 
5785 
5738 
5805 
5761 
406 
1657 
5769 
7905 
5736 

5801 
5739 
1641 
5865 
5737 
27030 



12 
13 
13 
12 
12 
12 
12 
12 
14 
14 
15 
14 
14 
14 
12 
16 

14 
15 
14 
16 
16 
16 



3.19640 
3.21393 
3.21305 
3.21930 
3.23607 

1 + V5 
3.26876 
3.27183 
3.28207 
3.34542 
3.36028 
3.36637 
3.39009 
3.39400 

2 + V2 
2^3 

3.51041 
3.51414 

l + \/7 
3.78478 

4 



3.21633 
3.21888 



3.27185 
3.27189 

3.34781 

3.37384 
3.39051 



3.51129 



3.33513 



Lemma 4.12 



Lemma 4.12 



Lemma 4.12 



{{xi (Sx2) A (x3 e Xi)) V (xi A X2 A A 0:4) 
xi (£ #60^a;2,X3,X4) 



EXACTi 



or 4 of 4 



Xi® X2® {X3 A X4) 

EXACT2of4 = Thr. 2 of 4(2^1, 3^2, 2^3, 3^4) A 
Thr.2 of 4(^, x^, x^) 



Lemma 4.12 



/ opt. NAND #82 8[xi ® a:2,X3,a;4) 



xi S 



EXACTJ 



#828>2,a;3,a;4) 



or 4 of 4 



/Lemma 4.12 PARITY4, a;2 ® X3 ® a;4 



We now list optimal adversary matrices and optimal span programs for the four-bit functions for which 
we know an optimal span program. For the adversary matrices, we include only the rows and columns with 
nonzero entries. 



Several of the four-bit functions, for example #287 MAJ3(a;i, a;2, 2:3 A X4), or #1647 MAJ3(a;i, 2:2, X3 



Xi), are compositions of a three- bit function with a two-bit function. Therefore, to consolidate cases and 
increase the generality of our results, it will sometimes be convenient to give span programs for three-bit 
functions with unbalanced input complexities. [Lemma 5.2| for example, implies optimal span programs for 
both functions |#287| and |#1647 Fo r the ad versary lower bound, it is also convenient to define the general 
adversary bound with costs |HLS07 . lHLS05| : 



Definition C.3 (Adversary bound with costs). Let f : {0,1}^^ 
positive reals. Define 

ii"pi 

Adv^(/) = max 



r^^o maxi 



iFo A 



{0, 1}, and let a £ R" be a vector of 



where the matrices Di are defined as in Definition 4-3 The maximum is over all 2^ x 2^ nonzero, symmetric 
matrices T satisfying (a;|r|y) = if f{x) — f{y). 



of 



This weighte d version of the adversary bound composes nicely, as shown by the following generalization 



Theorem 4.6 



still a special case of [HLS07, Theorem 13]: 



Theorem C.4 (|hl1o7]). Let f ^ go{hi, . . . , hk) and let a = (Adv=^(/ii), . . . , Adv=^(/ife)). T/ien Adv=^(/) > 
Adv±(/). 



HLS07I Theorem 12] shows that the weighted version of the nonnegative adversary bound composes exactly. 



i.e., the > sign can be replaced with equality, but equality is not known to hold for the general adversary 
bound. 
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|Thcorem C.4 lets us compute the adversary bound for the four-bit function :/^287 MAJ3(xi, X2, a;3 A x^), 
for example, by considering 2^ x 2^ adversary matrices for the three-bit majority function with costs a — 
(1,1,72). 



C.l Function |#831| , MAJ3, with partly unbalanced inputs: 

If the first two inputs have equal costs 1 and the third input has cost /3, then the optimal adversary matrix 
for function 1^831 1 MAJ3, comes from 



r = 



Oil 101 110 
100/0 P 1 
010 /3 1 
001 V 1 1 



The adversary bound is Adv^ ^ ^^(MAJs) — |(\/8 + (3^ + f3). An optimal span program for this function 
with equal first two input complexities is given in Lemma 5.2 Note that this also settles the complexities of 



functions #287 and #1647 



C.2 Function 7^9 75 with partly unbalanced inputs: 



Function #975 is (0:3 A a;2) V (a;3 A xi). If the first two inputs have equal costs 1 and the third input has cost 
/3, then the optimal adversary matrix comes from 

010 101 

r= 100/ 1 p \ 
ony 13 I j 



The adversary bound is Advi^ ^ „J#975l — fi+l. A span program with matching witness size is 



'(l,l,/3) 



Xj = {{Xi} {X^} {X-^} {X2}) 

110 
110 
11 

This function can be evaluated as an "if-then-else" statement, by evaluating the third input 2:3 at cost (3 
and then one of xi or X2 at cost 1. A span program with witness size /3-I- 1 is thus not surprising. Note that 



this also settles the complexities of functions #495 and #1695 



C.3 Function 7^960[ , EQUAL3, with partly unbalanced inputs: 



For function #960[ EQUAL3, the adversary bound when the first two inputs have equal costs 1 and the 
third input has cost (3 is 



/3+y2^ 



Adv± ,_^)(EQUAL3) 



Indeed, optimal adversary matrices are 



(3- 






000 


111 


100 


/ 2a 


a \ 


010 


2a 


a 


001 


2 


1 


on 


a 


2a 


101 


a 


2a 


110 


\ 1 


2 ) 



if < /3 < 72/5 
if ^275 < /3 < 2 
if /3 > 2 



and 



000 

im( v/2-^2 

f3 
f3 



010 
Oil 
101 



111 

[3 



\ 



v/2^ , 
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for the ranges < /? < -\/2/5, ■y/2/5 < /? < 2 and /3 > 2, respectively, where a = 
The optimal span program is 

Xj = ({xa} {xi,X2} {xl,xi\ {xi}) 

1 10 

w \ 

^00 I w 

1/2 



5/32-2- 



2(1-/32) 



for /3 < v/275, u; = 1 for ^275 < /3 < 2, and w = 1 /\/2 for /3 > 2. 
Note that this also settles the complexities of functions #424 EQUAL3(a;i, X2, ^3 A x^), and #1680 



where w 
Note 

EQUAL3(a;i, 2:2, x^ ® xa) 



C.4 Function ^^963 with partly unbalanced inputs: 



See Claim 4.11 for the balanced complexity case for function #963[ {xi A X2 A X3) V (aTf A 3^2). If the first 
two, symmetrical inputs have equal costs 1 and the third input has cost /3, the the optimal adversary matrix 
comes from 

000 001 111 
011/0 1 1 
101 1 1 
110 V 1 p 



r = 



The adversary bound is Adv^^^^_^)(#963 1 = -^{5 + (3^ + + 2(3^ + Z?*) 
witness size is 

= {{Xl} {X2,X3} {x^,x^}) 

oj' ^•'=1^ 1 «.2 ^ 

,1/2 



1/2 



A span program with matching 



t = 



where Wi ^ ^{l + (3^ + ^9 + 2(3^ + p-^Y''^ and W2 = ^7=^ ( - 3 + /^^ + ^9 + 213"^ + P'^f'^ . Note that this 



also settles the complexities of functions |#2032 #426 and #1776 



72/3 



C.5 Function #828, EXACT2of35 with partly unbalanced inputs: 



Function #828 is EXACT2 of z{xi,X2,xz) — MAJ3(xi, a;2, xa) A {xi V X2 V xs). If the first two inputs have 
equal costs 1 and the third input has cost /3, then the optimal adversary matrix comes from 



r = 



The adversary bound is Advj.-^ ^ ^^(#8281 
size is 



110 101 Oil 

001/0 1 1 \ 

1 13 

1 (3 

V /3 1 1 / 



010 
100 

111 



span program with matching witness 



Xj = 



{{xi,X2} {xz} {xi} {X2} {xa} ) 

1 it;2 W2 wi/\/2'^ 
Q i —i wi 
wi 10 



(a/8/32 ^ I _ l)/(2/3) and w| = 1/(^8/32 + 1+ 3). Note that this also settles the complexities 



where w 

of functions |#1912| [#286| and |#1641 
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C.6 Function [#393 



The optimal adversary matrix and a matching span program for function |7^393| are 



0010 1101 0111 1011 
0001 /I 3 \ 

1110 3 10 
0011 2^2 3 3 

1111 V 2^2 3 3 / 



Xj ^ {{xi,X2} {x^} {xi,X2} {X4,}) 





/372 









C.7 Function #989 



The optimal adversary matrix and a matching span program for function |^989| are 



0010 0111 1100 
0011 / 1 1 
0110 1 1 1 

noil 1 1 



X, 



{{X1,X2}?I {X2} {xs} {Xi} {Xi}) 











;•) 











1 1 



1 





1 2-1/-* 2'^/^ 
2^/4 1 



21/4 

1 




C.8 Function #1968 



The optimal adversary matrix and a matching span program for function |#1968| are 



0000 1110 0011 1101 

0010 / 3^7 2a/7 3%/7 \ 

1100 2V7 3V7 3^7 
1001 5 2 7 
0101 5 2 7 
0111 5 7 2 
1011 V 5 7 2 / 



t = 



Xj = {{xi,X2} {X^} {X4} {xi,X2} {X3} {X4}) 




V3/2 73/2 






73/2 ^/3/2, 



C.9 Function #1910 



The optimal adversary matrix and a matching span program for function #1910 

0001 0010 0100 1000 0011 1100 nil 



are 



0111 










1 





1 





1 


\ 


1011 













1 


1 





1 


1101 




1 














1 


1 




1110 


I 





1 











1 


1 


/ 



Xj = {{xi,X2,X3,X4} {xi,X2} {X3,X4}) 
^ 1 ),«./= ( V2 1 1 



C.IO Function #317 



The optimal adversary matrix for function #317[ {xi A X2 A 2:3) V MAJ3(a;2, X3, a;4), comes from 



0111 1010 1100 
1000/ 1 1 \ 
r= 0011 1 1 
0101 1 1 

1110 v 111/ 



A matching span program follows from plemma 4. 12| applied to the span programs for AND3 and MAJg 
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C.ll Function [#5790 : 

The optimal adversary matrix and a matching span program for function |7^5790| are 



0011 0100 1000 nil 
0000 / 1 1 1 \ 
110 1 
10 11 
V 1 1 1 / 



Xj = ({Xi} {X2,X3,} {X2,xz} {Xi} {x2,Xi} {x2,X3}) 



0111 
1011 
1100 













, VJ = \ 









C.12 Function #385 



The optimal adversary matrix and a matching span program for function #385 



are 



0111 1000 nil 
0000 1 ^/2^/2 \ 
1001 V2 1 
1010 ^/2 1 
1100 V ^2 1 / 



t = 




23/4^3 



{x2,a;3,a:4}) 

1 / 



C.13 Function |#279t Thresholds of 4: 

The optimal adversary matrix for function |#279| Threshold2 of 4, is 



0111 1011 1101 1110 



0011 




1 


1 








\ 


0101 




1 





1 







0110 




1 








1 




1100 










1 


1 




1010 







1 





1 




1001 


I 





1 


1 





/ 



A matching span program was given in [Example 5.1| 



C.14 Function #1639 



The optimal adversary matrix and a matching span program for function #1639 equivalent to the formula 
{xi A X2) V yiAi^{xi A X2, x^,X4), are 



0000 0101 1001 0110 1010 



0001 




1 


1 


1 





\ 


0010 




1 








1 1 




0111 







1 





1 




1011 










1 


1 




1100 




1 













1101 







1 


1 







1110 


I 











1 1 


/ 



Xj 

V.J = 



({2:1,2:2} {2:1,2:2} {2:3} {2:4}) 
/ 1 ^/b/2 1/2 1/2 \ 







1 



This span program is based on the one in [Lemma 5.2| 
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C.15 Function[#60T4| EXACT2or3of4: 

The optimal adversary matrix and a matching span program for function |^6014| are 



1000 0100 0010 0001 nil 



0011 


/ 








1 


1 


3-l/2\ 


0101 







1 





1 


3-1/2 


0110 







1 


1 





3-1/2 


1100 




1 


1 








3-1/2 


1010 




1 





1 





3-1/2 


1001 


V 


1 








1 


3-1/2/ 



Xj = {{xi} {xi} {x2] {x2] {xz] {a^s} {2:4} {xa} {xi} {X2] {a;3} {2^4}) 

)-l/4 2-1/4 2-1/4 2-1/4 

\/3 \/3 \/3 


/ 

This span program is based on the expansion EXACT2 or 3 of 4 = Threshold2 of 4(a;i, X2, x^, X4) A {xi V 3?2 V 







( ' 




























1 


1 


1 


1 


1 


1 


1 


1 







1 


1 


1 


-1 


i 


—i 


i 


i 








—i 


i 


i 


1 


1 


1 


-1 



X3 V X4), and the span program for Threshold2 of 4 #279 from Example 5.1 



C.16 Function #278, EXACTiof4: 



The optimal adversary matrix for function #278 EXACTi of 4 = Thresholds of 4(2:1, 2^2, 2:3, X4) A {xi V X2 V 
X3 V 0:4), is 

0111 1011 1101 1110 



r = 



0011 


/ 


1 


1 








\ 


0101 




1 





1 







0110 




1 








1 




1100 










1 


1 




1010 







1 





1 




1001 







1 


1 







nil 


I 


1 


1 


1 


1 


/ 



A span program with matching witness size \/lO follows from Lemma 4.12 applied to the span programs for 
OR4 and Thresholds of 4 [#279| 



C . 1 7 Function #5736 , EXACT2 of 4 : 



The optimal adversary matrix for function #278 EXACTi of 4 = Thr.2 of 4(2;!, . . . , X4)AThr.2 of 4(2:1, . . . , 2:4), 
is 

1000 0100 0010 0001 0111 1011 1101 1110 



0011 
0101 
0110 
1100 
1010 
1001 



/ 



1 
1 

V 1 



\ 

1 
1 
1 

/ 



A span program with matching witness size v 12 follows from Lemma 4.12 applied to the span program for 
Thresholds of 4 [#279| 
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